AWS Defense Evasion - Delete CloudTrail

This analytic detects AWS `DeleteTrail` events within CloudTrail logs, specifically leveraging Amazon Security Lake logs parsed in the Open Cybersecurity Schema Framework (OCSF) format. The purpose is to identify when a CloudTrail is deleted. This activity is significant because adversaries may delete CloudTrail logs to evade detection and operate with stealth. If confirmed malicious, this action could allow attackers to cover their tracks, making it difficult to trace their activities and investigate other potential compromises within the AWS environment.