Disable CloudTrail Logging Through Event Selectors
MITRE ATT&CK Tactics
- Defense Evasion
Disrupt CloudTrail Logging by creating an event selector on the Trail, filtering out all management events.
- Create a CloudTrail trail.
- Create a CloudTrail event selector to disable management events, through cloudtrail:PutEventSelectors
Identify when event selectors of a CloudTrail trail are updated, through CloudTrail's