[metadata]
creation_date = "2020/06/10"
maturity = "production"
updated_date = "2020/12/09"

[rule]
author = ["Elastic"]
description = """
Identifies suspending the recording of AWS API calls and log file delivery for the specified trail. An adversary may
suspend trails in an attempt to evade defenses.
"""
false_positives = [
    """
    Suspending the recording of a trail may be done by a system or network administrator. Verify whether the user
    identity, user agent, and/or hostname should be making changes in your environment. Trail suspensions from
    unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted
    from the rule.
    """,
]
from = "now-60m"
index = ["filebeat-*", "logs-aws*"]
interval = "10m"
language = "kuery"
license = "Elastic License"
name = "AWS CloudTrail Log Suspended"
note = "The AWS Filebeat module must be enabled to use this rule."
references = [
    "https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_StopLogging.html",
    "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/stop-logging.html",
]
risk_score = 47
rule_id = "1aa8fa52-44a7-4dae-b058-f3333b91c8d7"
severity = "medium"
tags = ["Elastic", "Cloud", "AWS", "Continuous Monitoring", "SecOps", "Log Auditing"]
type = "query"

query = '''
event.action:StopLogging and event.dataset:aws.cloudtrail and event.provider:cloudtrail.amazonaws.com and event.outcome:success
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"
[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

