2026 Critical Cloud Control Plane Detection: CloudTrail Event Selector Scope Tam
Detects modifications to AWS CloudTrail event selectors that result in a loss of audit coverage (e.g., stopping management event logging or narrowing the ReadWriteType), which is a technique used by sophisticated actors to silently evade detection while keeping the trail status as enabled.
Sigma
