AWS CloudTrail Important Configuration Change Detected
This rule detects critical changes to AWS CloudTrail configurations, specifically when a CloudTrail is stopped (StopLogging), updated (UpdateTrail), or deleted (DeleteTrail). These actions can indicate an attempt by an attacker to evade detection by disabling or modifying logging capabilities to obscure their activities within the AWS environment.
Sigma
