2026 Critical Cloud Control Plane Detection: CloudTrail Logging Stopped or Trail
Detects unauthorized attempts to stop CloudTrail logging or delete existing CloudTrail configurations within an AWS environment. Disabling logging is a significant indicator of defense evasion, often used by attackers to mask subsequent malicious activities such as data exfiltration, privilege escalation, or resource abuse.
Sigma
