Skip to content
Threat Feed
Subscribe

Tag

Log-Auditing

3 briefs RSS
high advisory

Detection of AWS Route 53 Resolver Query Log Deletion

Adversaries may delete Amazon Route 53 Resolver Query Log configurations to evade detection by disabling DNS query and response logging for VPC-based resources.

Route 53 cloud aws defense-evasion log-auditing persistence resource-development
2r 3t
low advisory

Monitoring AWS CloudTrail Creation for Unauthorized Log Diversion

Adversaries may use the CreateTrail API to establish unauthorized logging configurations that redirect audit data to attacker-controlled destinations or circumvent existing monitoring controls.

AWS CloudTrail +1 cloud aws log-auditing discovery cloudtrail
1r 4t updated
high advisory

AWS CloudTrail Log Updated

Adversaries can modify AWS CloudTrail configurations via the UpdateTrail API to reduce logging visibility, change log destinations, or weaken integrity, aiming to evade detection by preventing critical audit information from being collected or stored properly.

AWS CloudTrail cloud-security aws log-auditing impact defense-evasion
1r 2t