Monitoring AWS CloudTrail Creation for Unauthorized Log Diversion

The creation of new AWS CloudTrail trails is a critical security event that requires rigorous validation to ensure account integrity. While often associated with legitimate administrative onboarding or architectural changes, malicious actors utilize the CreateTrail API to deploy secondary trails. These trails can be configured to exfiltrate logs to attacker-controlled S3 buckets, limit regions to avoid detection of cross-region activity, or exclude specific event types to hide illicit actions.

Defenders must ensure that all new trails align with organizational standards, specifically regarding destination ownership, mandatory encryption using approved Customer Master Keys (CMKs), and multi-region coverage. Failure to monitor these API calls can lead to significant blind spots, as attackers may disable or subvert existing logging mechanisms while establishing their own persistent visibility into the environment. This intelligence highlights the need for continuous auditing of CreateTrail events to identify and remediate unauthorized modifications to cloud logging architecture.

Impact

Successful exploitation of cloud logging configurations enables attackers to exfiltrate sensitive operational data, mask malicious activity from security teams, and maintain persistent, stealthy access to cloud infrastructure. Unauthorized trails can redirect logs to external accounts, effectively compromising the organization's compliance posture and incident response capabilities, potentially resulting in data breach and loss of administrative control over AWS resources.

Recommendation

• Implement the following Sigma rule to detect CreateTrail API activity and integrate it into your SIEM pipeline for immediate triage.
• Restrict the cloudtrail:CreateTrail permission to authorized administrative IAM roles using IAM policies and Service Control Policies (SCPs).
• Use AWS Config or Security Hub to enforce organizational compliance standards, such as mandatory multi-region logging and valid destination buckets.
• Establish a manual review process for all new CloudTrail configurations to verify destination ownership and encryption settings before they are accepted as part of the baseline.