AWS CloudTrail Defense Evasion via DeleteTrail API

The AWS CloudTrail service provides an essential audit trail of API calls and resource modifications within an AWS environment. Attackers attempting to hide malicious activity often target this logging infrastructure to facilitate defense evasion. The DeleteTrail API call allows an authorized identity to remove an established log trail, effectively creating a blind spot in the organization's cloud monitoring and compliance posture. This behavior is frequently associated with the "Impair Defenses" tactic, as documented by MITRE ATT&CK under technique T1562.008. Defenders should monitor for successful DeleteTrail events, particularly when initiated by non-administrative accounts, unusual source IP addresses, or unknown user agents, as these may signal active compromise or the final stages of an adversarial campaign aimed at destroying forensic evidence.

Impact

Successful exploitation of this technique results in the immediate loss of visibility into administrative actions, resource configuration changes, and potential exfiltration activities within an AWS account. If an organization fails to maintain redundant, multi-region, or organization-level logging, the deletion of a single trail can effectively wipe the entire audit history for that account, hindering incident response and forensic investigation efforts.

Recommendation

• Deploy monitoring for the DeleteTrail event in AWS CloudTrail logs to trigger immediate SOC alerts for investigation.
• Hardening: Implement Service Control Policies (SCPs) or AWS Config rules to restrict the ability to call DeleteTrail to specific break-glass roles.
• Ensure high-availability logging by configuring organization-level CloudTrail trails with log file integrity validation enabled.
• Prioritize investigation of DeleteTrail events involving unexpected user identities, unapproved source IPs, or unfamiliar user agents identified in the telemetry.