logging.sinks.delete

CSP: GCP

Tactics:

Defense Evasion

Techniques:

T1562.008

Tags:

GCP Cloud Logging

Event

Deletes a Cloud Logging sink that was routing log entries to a destination such as Cloud Storage or BigQuery.

Security Context

• Deleting or modifying audit logs destroys forensic evidence and prevents security teams from reconstructing the attack timeline.

Log Source

Cloud Audit Logs

Sample Event

MITRE ATT&CK Mapping

Tactics: Defense Evasion

Techniques:

• T1562.008 — Disable or Modify Cloud Logs — An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...