Skip to content

T1562.008 Disable or Modify Cloud Logs

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.3 They may alternatively tamper with logging functionality – for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.27 In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.5

Item Value
ID T1562.008
Sub-techniques T1562.001, T1562.002, T1562.003, T1562.004, T1562.006, T1562.007, T1562.008, T1562.009, T1562.010, T1562.011, T1562.012, T1562.013
Tactics TA0005
Platforms IaaS, Identity Provider, Office Suite, SaaS
Version 2.1
Created 12 October 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0016 APT29 APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.9
S1091 Pacu Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.8

Mitigations

ID Mitigation Description
M1018 User Account Management Configure default account policy to enable logging. Manage policies to ensure only necessary users have permissions to make changes to logging policies.

References

  1. Amazon Web Services. (n.d.). Stopping CloudTrail from Sending Events to CloudWatch Logs. Retrieved October 16, 2020. ↩

  2. AWS. (n.d.). update-trail. Retrieved August 4, 2023. ↩

  3. Dan Whalen. (2019, September 10). Following the CloudTrail: Generating strong AWS security signals with Sumo Logic. Retrieved October 16, 2020. ↩

  4. Google. (n.d.). Configuring Data Access audit logs. Retrieved October 16, 2020. ↩

  5. Kelly Sheridan. (2021, August 5). Incident Responders Explore Microsoft 365 Attacks in the Wild. Retrieved March 17, 2023. ↩

  6. Microsoft. (n.d.). az monitor diagnostic-settings. Retrieved October 16, 2020. ↩

  7. Rhino Security Labs. (2021, April 29). Pacu Detection Disruption Module. Retrieved August 4, 2023. ↩

  8. Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019. ↩

  9. Douglas Bienstock. (2022, August 18). You Can’t Audit Me: APT29 Continues Targeting Microsoft 365. Retrieved February 23, 2023. ↩