2026 Critical Cloud Control Plane Detection: Log Export Sink or Destination Modified to Suppress or Redirect Audit Data
Detects modifications to AWS CloudTrail logging configurations, specifically changes to trails or subscription filters that could be used to suppress, redirect, or disrupt the collection of audit logs, potentially masking malicious activity.
Sigma
