First Action After Compromise: Blind the Audit
✓ Human-authored analysis; AI used for formatting and proofreading. If you're an attacker who's just landed in an AWS account, the most expensive thing about your future is detection. Every API call you make leaves a trail in CloudTrail, gets forwarded to a SIEM, becomes evidence the team uses to boot you out and reconstruct what you touched. The cost of your campaign rises linearly with the…
When an attacker gains unauthorized access to an AWS account, their actions are often detected through CloudTrail logs, which are then forwarded to a SIEM for monitoring and evidence collection. To evade detection, attackers can temporarily disable the audit trail by stopping the logging of events, effectively blinding the investigation.
This can be achieved by executing the command "aws cloudtrail stop-logging --name org-audit-trail," which stops the CloudTrail trail from recording new events. The audit trail remains configured, but the IsLogging field in the trail status indicates that it is currently set to false. This action allows the attacker to perform various malicious activities without leaving a trace in the audit logs, such as credential exfiltration, creating persistent access, and rewriting evidence.
The absence of CloudTrail events makes it difficult for investigators to determine the attacker's actions during the blind window, which can last for several days. This technique is well-known and documented in various incident response guides and penetration testing reports. To detect this tactic, security teams need to monitor the cloudtrail:StopLogging API call and check the IsLogging boolean status of each trail.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
