# T1562.008 - Disable Cloud Logs
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1562/008)
<blockquote>An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. 

Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an attacker has sufficient permissions, they can disable logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic)</blockquote>

## Atomic Tests

- [Atomic Test #1 - AWS CloudTrail Changes](#atomic-test-1---aws-cloudtrail-changes)


<br/>

## Atomic Test #1 - AWS CloudTrail Changes
Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail

**Supported Platforms:** Iaas:aws


**auto_generated_guid:** 9c10dc6b-20bd-403a-8e67-50ef7d07ed4e





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| cloudtrail_name | Name of the cloudTrail | String | redatomictesttrail|
| s3_bucket_name | Name of the bucket | String | redatomic-test|
| region | Name of the region | String | us-east-1|


#### Attack Commands: Run with `sh`! 


```sh
aws cloudtrail create-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name} --region #{region}
aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}
```

#### Cleanup Commands:
```sh
aws s3 rb s3://#{s3_bucket_name} --force
```



#### Dependencies:  Run with `sh`!
##### Description: Check if ~/.aws/credentials file has a default stanza is configured
##### Check Prereq Commands:
```sh
cat ~/.aws/credentials | grep "default"
aws s3api create-bucket --bucket #{s3_bucket_name} --region #{region}
aws s3api put-bucket-policy --bucket #{s3_bucket_name} --policy file://$PathToAtomicsFolder/T1562.008/src/policy.json
```
##### Get Prereq Commands:
```sh
echo Please install the aws-cli and configure your AWS defult profile using: aws configure
```




<br/>
