AWS CloudTrail Logging Tampering Detected
This rule detects when AWS CloudTrail logging configurations are modified, stopped, or deleted. Specifically, it looks for API calls such as 'UpdateTrail', 'StopLogging', 'DeleteTrail', or 'PutEventSelectors' that indicate an attempt to tamper with CloudTrail's ability to record events. Such actions could be performed by an adversary to evade detection by hiding their activities.
YARA-L
