AWS DeleteEventDataStore
Deletes a CloudTrail Lake event data store, destroying stored forensic evidence and audit logs.
T1685.002: Disable or Modify Cloud Log
T1685.002: Disable or Modify Cloud Log
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...
View on MITRE ATT&CK →AWS DeleteFlowLogs
Deletes VPC Flow Log configurations, stopping the capture of network traffic metadata for the specified resources.
AWS DeleteLogGroup
Permanently deletes a CloudWatch Logs log group and all its log streams and stored data.
AWS DeleteLogStream
Permanently deletes a log stream and all its events from within a CloudWatch Logs log group.
AWS DeleteTrail
Permanently deletes a CloudTrail trail, stopping API activity logging for that trail configuration.
GCP google.logging.v2.ConfigServiceV2.UpdateExclusion
Modifies a logging exclusion filter to silently drop specific log entries, hiding ongoing attacker activity.
GCP google.logging.v2.LoggingServiceV2.DeleteLog
Deletes log entries from Cloud Logging, destroying forensic evidence of attacker activity.
GCP logging.projects.exclusions.create
Creates a log exclusion rule in Cloud Logging that prevents matching log entries from being ingested.
GCP logging.sinks.delete
Deletes a Cloud Logging sink that was routing log entries to a destination such as Cloud Storage or BigQuery.
GCP logging.sinks.update
Modifies a Cloud Logging sink's configuration, such as its destination or log filter criteria.
Azure Microsoft.Insights/diagnosticSettings/delete
Deletes an Azure Monitor diagnostic setting, stopping the forwarding of logs and metrics to a configured destination.
Azure Microsoft.Network/networkWatchers/flowLogs/delete
Deletes an NSG flow log configuration, stopping the capture of network traffic metadata for a network security group.
Azure Microsoft.OperationalInsights/workspaces/delete
Permanently deletes a Log Analytics workspace and its stored data.
Azure Microsoft.Storage/storageAccounts/stopLogging/action
Stops logging for an Azure Storage account, disabling the collection of storage analytics logs.
AWS PutEventSelectors
Configures which API events (management or data, read/write) a CloudTrail trail records.
AWS StopLogging
Stops logging API activity for a CloudTrail trail, disabling audit log collection for that trail.
AWS UpdateTrail
Modifies the configuration of an existing CloudTrail trail, such as its S3 bucket, log validation, or multi-region settings.