T1685.002 · defense-impairment · ATT&CK 19.1

Disable or Modify Cloud Log

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)

Open in the interactive knowledge mesh

Detection overview

Use the published detection strategies below and validate required telemetry in the target environment.

Observed groups

APT29
G0016

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Module 12 — Incident response, DFIR, crisis coordination, and recovery
Blue Team & Defensive Security · topic-match · 60/100Module 1 — Defensive mission, operating model, and SOC service
Blue Team & Defensive Security · topic-match · 48/100Module 3 — Telemetry and logging architecture
Blue Team & Defensive Security · topic-match · 48/100Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · tactic-route · 24/100Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · tactic-route · 24/100Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · tactic-route · 24/100

MITRE mitigations

M1018 · User Account Management

User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures: Enforcing the Principle of Least Privilege - Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions. Implementing Strong Password Policies - Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90…

MITRE mitigation source

MITRE detection strategies and analytics

DET0289 · Detection Strategy for Disable or Modify Cloud Log
  • AN0801 · Analytic 0801 — Cloud API events where logging services are stopped, deleted, or modified in a way that disables audit visibility. Defender view: unauthorized StopLogging, DeleteTrail, or UpdateSink operations correlated with privileged user activity.
  • AN0802 · Analytic 0802 — Disabling or modifying sign-in or audit log collection for user activities. Defender view: policy or configuration updates removing logging coverage for critical accounts.
  • AN0803 · Analytic 0803 — Disabling mailbox or tenant-level audit logging, often using Set-MailboxAuditBypassAssociation or downgrading license tiers. Defender view: sudden absence of mailbox activity logging for monitored users.
  • AN0804 · Analytic 0804 — Disabling or altering security and audit logs in SaaS admin panels (e.g., Slack, Zoom, Salesforce). Defender view: API calls or admin console changes that stop event exports or logging integrations.
MITRE detection source