Cloud Audit Logging Disabled or Tampered (T1562.008)
Detects attempts to tamper with, disable, or delete audit logging configurations in AWS CloudTrail and Azure Monitor. Monitoring these activities is critical to ensure that audit logs remain intact for security investigations.
Microsoft Sentinel (KQL)
