↳ GitHub sourceAnalytics ruleLow

AWSCloudTrail - Failed Attempts to Change AWS CloudTrail Logs

Description

Identifies FAILED or denied attempts to manipulate AWS CloudTrail, CloudWatch/EventBridge, or VPC Flow Logs. Successful manipulation is covered by the higher-severity 'AWSCloudTrail - Successful Tampering with AWS CloudTrail Logs' rule. These failed attempts can indicate reconnaissance or an actor probing for insufficient permissions as part of defense evasion. For more information, visit: AWS CloudTrail API: https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_Operations.html AWS CloudWatch/EventBridge API: https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Operations.html AWS DeleteFlowLogs API: https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html

Rule type: Scheduled
Version: 1.0.6
Declared status: Available
Query frequency: 1d
Query period: 1d
Trigger: gt 0

Declared MITRE coverage

DefenseEvasion T1562.008

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AWS AWSS3

Data types

AWSCloudTrail

KQL query

Original query, unchanged.

let EventNameList = dynamic(["UpdateTrail","DeleteTrail","StopLogging","DeleteFlowLogs","DeleteEventBus","DeleteLogGroup"]);
AWSCloudTrail
| where (EventName in~ (EventNameList) or (EventName == "UpdateTrail" and (parse_json(RequestParameters).enableLogFileValidation) == false) or (EventName == "UpdateTrail" and (parse_json(RequestParameters).isMultiRegionTrail) == false)) and (isnotempty(ErrorMessage) or isnotempty(ErrorCode))
| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by EventName, EventTypeName, RecipientAccountId, AccountName, AccountUPNSuffix, UserIdentityAccountId, UserIdentityPrincipalid, UserAgent,
UserIdentityUserName, SessionMfaAuthenticated, SourceIpAddress, AWSRegion, EventSource

Declared entities

AccountIP

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Amazon Web Services/Analytic Rules/AWS_ClearStopChangeTrailLogs.yaml ↗
Commit: 9800e51 ↗
Source identifier: 610d3850-c26f-4f20-8d86-f10fdf2425f5

Additional source files 3

Solutions/Amazon Web Services/Analytic Rules/AWS_ClearStopChangeTrailLogs.yamlsource ↗Detections/AWSCloudTrail/AWS_ClearStopChangeTrailLogs.yamlmigration-note ↗Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.