Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1562.008

Disable or Modify Cloud Logs

Stealth deprecated 30 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Potential Destructive AWS CLI Command Executed by GenAI Agent production 2026-10-23
elastic GCP Vertex AI Publisher Model Config Modified production 2026-10-02
elastic Anthropic Compliance API Logging Disabled production 2026-09-25
elastic AWS Bedrock Model Invocation Logging Disabled or Modified production 2026-09-25
elastic AWS CloudTrail Log Suspended production 2026-09-18
elastic AWS CloudTrail Management Events Disabled via PutEventSelectors production 2026-09-18
elastic AWS Config Resource Deletion production 2026-09-18
elastic AWS Configuration Recorder Stopped production 2026-09-18
elastic AWS VPC Flow Logs Deletion production 2026-09-18
elastic AWS EKS Control Plane Logging Disabled production 2026-09-18
elastic AWS Route 53 Resolver Query Log Configuration Deleted production 2026-09-18
elastic AWS S3 Bucket Configuration Deletion production 2026-09-18
elastic AWS S3 Bucket Expiration Lifecycle Configuration Added production 2026-09-18
elastic AWS S3 Bucket Server Access Logging Disabled production 2026-09-18
elastic AWS SQS Queue Purge production 2026-09-18
elastic AWS CloudWatch Log Group Deletion production 2026-09-18
elastic AWS CloudWatch Log Stream Deletion production 2026-09-18
elastic Azure Event Hub Deleted production 2026-09-18
elastic Azure Diagnostic Settings Deleted production 2026-09-18
elastic Azure Kubernetes Services (AKS) Kubernetes Events Deleted production 2026-09-18
elastic Azure VNet Network Watcher Deleted production 2026-09-18
elastic GCP Logging Bucket Deletion production 2026-09-18
elastic GCP Logging Sink Deletion production 2026-09-18
elastic GCP Logging Sink Modification production 2026-09-18
elastic AWS CloudTrail Log Updated production 2026-09-18
elastic AWS CloudTrail Log Created production 2026-09-18
elastic AWS CloudTrail Log Deleted production 2026-09-18
elastic AWS CloudTrail Log Evasion production 2026-09-18
elastic AWS Audit or Security Service Tampering via CLI production 2026-09-14
sentinel Azure Diagnostic settings removed from a resource Scheduled —