ATT&CK technique

T1685.002

Disable or Modify Cloud Log

Defense Impairment 22 detections found

Detection rules

Source	Rule	Status	Updated
splunk	O365 Email Security Feature Changed	production	2026-05-13
splunk	GitHub Enterprise Modify Audit Log Event Stream	production	2026-05-13
splunk	GitHub Enterprise Pause Audit Log Event Stream	production	2026-05-13
splunk	O365 Advanced Audit Disabled	production	2026-05-13
splunk	ASL AWS Defense Evasion Delete Cloudtrail	production	2026-05-13
splunk	ASL AWS Defense Evasion Delete CloudWatch Log Group	production	2026-05-13
splunk	ASL AWS Defense Evasion Impair Security Services	production	2026-05-13
splunk	ASL AWS Defense Evasion PutBucketLifecycle	production	2026-05-13
splunk	ASL AWS Defense Evasion Stop Logging Cloudtrail	production	2026-05-13
splunk	ASL AWS Defense Evasion Update Cloudtrail	production	2026-05-13
splunk	AWS Bedrock Delete GuardRails	production	2026-05-13
splunk	AWS Bedrock Delete Model Invocation Logging Configuration	production	2026-05-13
splunk	AWS Defense Evasion Delete Cloudtrail	production	2026-05-13
splunk	AWS Defense Evasion Delete CloudWatch Log Group	production	2026-05-13
splunk	AWS Defense Evasion Impair Security Services	production	2026-05-13
splunk	AWS Defense Evasion PutBucketLifecycle	production	2026-05-13
splunk	AWS Defense Evasion Stop Logging Cloudtrail	production	2026-05-13
splunk	AWS Defense Evasion Update Cloudtrail	production	2026-05-13
splunk	GitHub Enterprise Disable Audit Log Event Stream	production	2026-05-13
sigma	AWS GuardDuty Detector Deleted Or Updated	experimental	2025-11-27
sigma	AWS Config Disabling Channel/Recorder	test	2022-10-09
sigma	AWS CloudTrail Important Change	test	2022-10-09