# T1685.002 - Disable or Modify Tools: Disable or Modify Cloud Log

## Description from ATT&CK

> An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
> 
> For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)

[Source](https://attack.mitre.org/techniques/T1685/002)

## Atomic Tests

- [Atomic Test #1: AWS - CloudTrail Changes](#atomic-test-1-aws---cloudtrail-changes)
- [Atomic Test #2: Azure - Eventhub Deletion](#atomic-test-2-azure---eventhub-deletion)
- [Atomic Test #3: Office 365 - Exchange Audit Log Disabled](#atomic-test-3-office-365---exchange-audit-log-disabled)
- [Atomic Test #4: AWS - Disable CloudTrail Logging Through Event Selectors using Stratus](#atomic-test-4-aws---disable-cloudtrail-logging-through-event-selectors-using-stratus)
- [Atomic Test #5: AWS - CloudTrail Logs Impairment Through S3 Lifecycle Rule using Stratus](#atomic-test-5-aws---cloudtrail-logs-impairment-through-s3-lifecycle-rule-using-stratus)
- [Atomic Test #6: AWS - Remove VPC Flow Logs using Stratus](#atomic-test-6-aws---remove-vpc-flow-logs-using-stratus)
- [Atomic Test #7: AWS - CloudWatch Log Group Deletes](#atomic-test-7-aws---cloudwatch-log-group-deletes)
- [Atomic Test #8: AWS CloudWatch Log Stream Deletes](#atomic-test-8-aws-cloudwatch-log-stream-deletes)
- [Atomic Test #9: Office 365 - Set Audit Bypass For a Mailbox](#atomic-test-9-office-365---set-audit-bypass-for-a-mailbox)
- [Atomic Test #10: GCP - Delete Activity Event Log](#atomic-test-10-gcp---delete-activity-event-log)
- [Atomic Test #11: AWS - Config Logs Disabled](#atomic-test-11-aws---config-logs-disabled)

### Atomic Test #1: AWS - CloudTrail Changes

Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail

**Supported Platforms:** Iaas:aws

**auto_generated_guid:** `9c10dc6b-20bd-403a-8e67-50ef7d07ed4e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| cloudtrail_name | Name of the cloudTrail | string | redatomictesttrail|
| s3_bucket_name | Name of the bucket | string | redatomic-test|
| region | Name of the region | string | us-east-1|

#### Attack Commands: Run with `sh`!

```sh
aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}
```

#### Cleanup Commands

```sh
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/"
terraform destroy -auto-approve
```

#### Dependencies: Run with `sh`!

##### Description: Check if ~/.aws/credentials file has a default stanza is configured

###### Check Prereq Commands

```sh
cat ~/.aws/credentials | grep "default"
```

###### Get Prereq Commands

```sh
echo Please install the aws-cli and configure your AWS default profile using: aws configure
```

##### Description: Check if terraform is installed.

###### Check Prereq Commands

```sh
terraform version
```

###### Get Prereq Commands

```sh
echo Please install the terraform and configure your aws default profile
```

##### Description: Check if the dependency resources are already present.

###### Check Prereq Commands

```sh
if [ -f "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/terraform.tfstate" ]; then exit 0; else exit 1; fi;
```

###### Get Prereq Commands

```sh
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-1/"
terraform init
terraform apply -auto-approve
```

### Atomic Test #2: Azure - Eventhub Deletion

Identifies an Event Hub deletion in Azure.
An Event Hub is an event processing service that ingests and processes large volumes of events and data.
An adversary may delete an Event Hub in an attempt to evade detection.
https://docs.microsoft.com/en-us/azure/event-hubs/event-hubs-about.

**Supported Platforms:** Iaas:azure

**auto_generated_guid:** `5e09bed0-7d33-453b-9bf3-caea32bff719`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| username | Azure username | string | |
| password | Azure password | string | |
| event_hub_name | Name of the eventhub | string | test_eventhub|
| resource_group | Name of the resource group | string | |
| name_space_name | Name of the NameSpace | string | |

#### Attack Commands: Run with `powershell`!

```powershell
$secure_pwd = "#{password}" | ConvertTo-SecureString -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential -ArgumentList "#{username}", $secure_pwd
Connect-AzureAD -Credential $creds
Remove-AzEventHub -ResourceGroupName #{resource_group} -Namespace #{name_space_name} -Name #{event_hub_name}
```

#### Cleanup Commands

```powershell
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/"
terraform destroy -auto-approve
```

#### Dependencies: Run with `powershell`!

##### Description: Install-Module -Name Az

###### Check Prereq Commands

```powershell
try {if (Get-InstalledModule -Name AzureAD -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}
```

###### Get Prereq Commands

```powershell
Install-Module -Name AzureAD -Force
```

##### Description: Check if terraform is installed.

###### Check Prereq Commands

```powershell
terraform version
```

###### Get Prereq Commands

```powershell
echo Please install the terraform.
```

##### Description: Check if the user is logged into Azure.

###### Check Prereq Commands

```powershell
az account show
```

###### Get Prereq Commands

```powershell
echo Configure your Azure account using: az login.
```

##### Description: Create dependency resources using terraform

###### Check Prereq Commands

```powershell
try {if (Test-Path "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/terraform.tfstate" ){ exit 0 } else {exit 1}} catch {exit 1}
```

###### Get Prereq Commands

```powershell
cd "$PathToAtomicsFolder/T1685.002/src/T1685.002-2/"
terraform init
terraform apply -auto-approve
```