AWS DeleteBucket
Deletes an empty S3 bucket, after all object versions and delete markers are removed.
T1685.002: Disable or Modify Cloud Log
T1685.002: Disable or Modify Cloud Log
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...
View on MITRE ATT&CK →AWS DeleteEventDataStore
Disables a CloudTrail Lake event data store and starts a seven-day deletion window.
AWS DeleteFlowLogs
Deletes selected VPC Flow Log configurations without deleting their previously delivered log data.
AWS DeleteLogGroup
Deletes a CloudWatch Logs group and permanently removes its stored log events.
AWS DeleteLogStream
Deletes a CloudWatch Logs stream and permanently removes its stored events.
AWS DeleteObjects
Requests deletion of multiple S3 object keys or specific versions in one batch.
AWS DeleteTrail
Deletes a CloudTrail trail and stops its future collection without deleting previously delivered logs.
GCP google.logging.v2.ConfigServiceV2.UpdateExclusion
Updates an exclusion in a resource’s _Default logging sink.
GCP google.logging.v2.LoggingServiceV2.DeleteLog
Deletes a named log’s entries from the global _Default log bucket.
GCP logging.projects.exclusions.create
Creates an exclusion in a resource’s _Default logging sink.
GCP logging.sinks.delete
Deletes a Cloud Logging sink.
GCP logging.sinks.update
Updates a Cloud Logging sink’s configuration.
Azure Microsoft.EventHub/namespaces/eventhubs/delete
Deletes an Event Hub entity within an Azure Event Hubs namespace.
Azure Microsoft.Insights/diagnosticSettings/delete
Deletes an Azure Monitor diagnostic setting and its configured export routes.
Azure Microsoft.Network/networkWatchers/flowLogs/delete
Deletes an Azure Network Watcher flow-log configuration.
Azure Microsoft.OperationalInsights/workspaces/delete
Deletes an Azure Log Analytics workspace, with optional permanent deletion.
AWS PutBucketLifecycleConfiguration
Creates or replaces an S3 bucket lifecycle configuration.
AWS PutEventSelectors
Configures basic or advanced selectors that determine which events a CloudTrail trail records.
AWS StopLogging
Stops logging API activity for a CloudTrail trail, disabling audit log collection for that trail.
Azure Storage Analytics logging disabled
Disables selected legacy Azure Storage Analytics logging categories.
AWS UpdateTrail
Changes a CloudTrail trail configuration, including delivery destinations, regional scope, and log-file validation.