T1685.002sub-technique of T1685 Disable or Modify Tools
Disable or Modify Cloud Log
IaaS · SaaS · Identity Provider · Office Suite1 piece on this siteT1685.002 on attack.mitre.org
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Ransomware, suspected or confirmed
Files renamed or unreadable, a ransom note, or backup deletion commands seen.
The evidence it leaves
Where the traces live, and what each source proves and does not.
AWS CloudTrail
how MITRE says to see it
Detection Strategy for Disable or Modify Cloud Log
- Cloud API events where logging services are stopped, deleted, or modified in a way that disables audit visibility. Defender view: unauthorized StopLogging, DeleteTrail, or UpdateSink operations correlated with privileged user activity.
- Disabling or modifying sign-in or audit log collection for user activities. Defender view: policy or configuration updates removing logging coverage for critical accounts.
- Disabling mailbox or tenant-level audit logging, often using Set-MailboxAuditBypassAssociation or downgrading license tiers. Defender view: sudden absence of mailbox activity logging for monitored users.
- Disabling or altering security and audit logs in SaaS admin panels (e.g., Slack, Zoom, Salesforce). Defender view: API calls or admin console changes that stop event exports or logging integrations.
what reduces it
- M1018 User Account Management. Configure default account policy to enable logging. Manage policies to ensure only necessary users have permissions to make changes to logging policies.