Anvilogic high experimental other

CloudTrail Logs Deleted [snowflake-awscloudtrail]

An adversary may delete trails in an attempt to evade defenses. -- Threat Actor Association: LUCR-3

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_type = 'AwsApiCall' and event_name = 'DeleteTrail'

Field Validations

Loading…

Comments (0)

Loading comments...