2026 Critical Cloud Control Plane Detection: CloudTrail or Cloud Audit Logging Disablement
Detects unauthorized attempts to stop, delete, modify, or change event selectors for AWS CloudTrail logs. This activity is indicative of an attacker attempting to disable audit logging to evade detection while performing further malicious actions in the environment.
Sigma
