AWS CloudTrail Logging Disabled via API

Darshan Thummar@Mighty

•updated Jun 11, 2026•3•0•10

This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.