Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

Summary: Unit 42 describes five techniques attackers use against cloud logging services: disabling logging, deleting the storage bucket, deleting the log router (via the delete-trail AWS API or the Google Cloud DeleteSink method), altering encryption keys so logs become unreadable, and poisoning stored JSON logs. It also describes two techniques for continuous visibility - creating a new trail or sink pointed at an attacker-controlled destination, or redirecting an existing one - noting that CreateTrail appears in CloudTrail only for certain accounts and that larger organizations may not use AWS-native services that would detect a redirected trail.

What's compelling: Every security product in the environment reads from these logs, so an attacker who deletes a trail or sink blinds the SOC entirely. AWS keeps an immutable 90-day CloudTrail Event History of management events as a fallback, but data and network events do not appear in it - and Google Cloud's built-in _Required and _Default buckets do not cover manually configured buckets built for external integrations.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Cloud Security
Related