Home/ATT&CK Technique/Disable or Modify Cloud Logs
ATT&CK Technique

Disable or Modify Cloud Logs

T1562.008 · stealth

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.

For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality - for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.

IaaSSaaSOffice SuiteIdentity Provider
◆

Actors Using This

3
russiaAPT29
predominantly_english_speaking_youth_organized_crimeLAPSUS$
predominantly_westernScattered Spider
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
initial-access same
T1566.003 · Spearphishing via Service ×3.35
persistence same
T1098.001 · Additional Cloud Credentials ×23.80T1098.002 · Additional Email Delegate Permissions ×23.80T1098.005 · Device Registration ×19.83T1556 · Modify Authentication Process ×15.87T1078.004 · Cloud Accounts ×4.49T1078.003 · Local Accounts ×3.66
credential-access same
T1621 · Multi-Factor Authentication Request Generation ×59.50T1003.006 · DCSync ×9.52T1552.004 · Private Keys ×6.80
discovery same
T1087.004 · Cloud Account ×47.60T1087.002 · Domain Account ×3.22
collection same
T1074.002 · Remote Data Staging ×29.75T1213.003 · Code Repositories ×18.31
other same
T1562.004 · Disable or Modify System Firewall ×5.17
◈

Detection Coverage

0/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) none
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
▣

Comply & Defend

NIST 800-53AC-02, AC-03, AC-05, AC-06, CM-03, CM-05, IA-02
D3FEND2 defensive techniques
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin