Executive Summary
Cloud logging services are a critical system of record for defenders, but they are increasingly targeted by adversaries seeking to evade detection or establish continuous visibility. By manipulating log storage, routers, and encryption keys, attackers can create diagnostic blind spots that render SIEM, SOAR, and CSPM tools ineffective. This research focuses on AWS and Google Cloud Platform (GCP) environments, highlighting how misconfigurations or over-privileged access to logging resources can be weaponized.
Technical analysis identifies two primary goals: defense evasion through log suppression or poisoning, and continuous visibility through the redirection of audit logs to attacker-controlled accounts. In AWS, this involves the manipulation of CloudTrail and S3, while in GCP, it involves the misuse of log sinks and buckets. The impact ranges from the destruction of forensic evidence to real-time exfiltration of operational data.
Organizations must treat logging configurations as high-value assets. Restricting administrative permissions for log modification and enabling cryptographic log integrity validation are essential steps to maintain a reliable audit trail and ensure incident response capabilities are not compromised.