2026 Critical Cloud Control Plane Detection - AWS CloudTrail Logging Disabled or Tampered
Detects unauthorized attempts to disable, delete, or weaken AWS CloudTrail logging and supporting infrastructure. This includes stopping log delivery, deleting trails, reducing scope via event selectors, removing VPC flow logs or CloudWatch log groups, and unauthorized administrative actions against the S3 bucket designated for CloudTrail logs.
YARA-L
