Attackers Evade Detection by Abusing Cloud Logging Services

Key Takeaways

• Threat actors are actively abusing cloud logging services like AWS CloudTrail and Google Cloud Logging to evade detection and maintain persistent access within compromised cloud environments.
• Attackers employ tactics such as disabling log collection, deleting log storage, manipulating encryption keys, and poisoning log files to blind security teams.
• Beyond evasion, adversaries are also redirecting log data to their own controlled environments, enabling long-term surveillance and stealthy lateral movement.
• Palo Alto Networks Unit 42 highlighted the severe consequences, ranging from complete loss of visibility to covert data exfiltration.
• Organizations must implement stringent access controls for logging resources and enable integrity validation features to mitigate these advanced threats.

Attackers Weaponize Cloud Logging to Evade Detection and Persist

Cyber adversaries are increasingly exploiting critical cloud logging infrastructure, transforming these essential security mechanisms into tools for stealth and persistence, according to new research from Palo Alto Networks Unit 42. Instead of providing a definitive record of activity, services like AWS CloudTrail and Google Cloud Logging are being manipulated to create significant blind spots within compromised cloud environments.

Cloud logging platforms serve as the authoritative source for tracking all actions across an organization’s cloud footprint. Security teams depend on these logs to feed their Security Information and Event Management (SIEM), Security Orchestration, Automation, and Response (SOAR), and Cloud Security Posture Management (CSPM) tools. However, once attackers gain sufficient privileges, they can disrupt this visibility or even exfiltrate log data for their own malicious monitoring.

Two Primary Attack Vectors: Evasion and Continuous Visibility

Researchers have identified two main categories for these attacks: defense evasion and continuous visibility. In defense evasion scenarios, the primary goal is to prevent detection by disabling or tampering with logging mechanisms. Conversely, continuous visibility tactics involve an attacker secretly siphoning off log data to maintain long-term insight into a victim’s activities.

Defense Evasion Techniques

One of the most direct methods for defense evasion involves completely stopping log collection. In AWS, threat actors with CloudTrail:StopLogging permissions can halt logging via API calls, instantly severing the flow of critical security data. Similarly, on Google Cloud, disabling logging sinks is possible for attackers possessing logging.sinks.Update permissions.

Another prevalent technique involves the deletion of log storage destinations. For instance, an attacker with s3:DeleteBucket permissions can remove CloudTrail log buckets in AWS, effectively destroying forensic evidence. While Google Cloud log buckets can also be deleted, they enter a delayed-deletion state, offering a narrow window for recovery.

More sophisticated attackers may impair logging by manipulating encryption keys. This involves replacing legitimate AWS Key Management Service (KMS) keys with attacker-controlled keys and subsequently revoking access. The result is that logs become unreadable or fail to be written altogether. A parallel attack can be executed in Google Cloud using customer-managed encryption keys (CMEK), effectively locking defenders out of their own log data.

Log poisoning represents another subtle evasion tactic. Attackers with object-level access can download, modify, and re-upload log files stored in services like Amazon S3. This compromises data integrity, leading incident response teams astray with falsified information.

Continuous Visibility Tactics

Beyond simply avoiding detection, threat actors are also leveraging logging systems to gain continuous visibility. Instead of performing active reconnaissance that might trigger alerts, adversaries can configure new log routing mechanisms to send copies of sensitive log data directly to their own controlled environments.

In AWS, this involves creating new CloudTrail trails that point to external S3 buckets. On Google Cloud, attackers abuse logging sinks to redirect logs. This log redirection is particularly perilous as it silently streams real-time activity, including IAM changes, VM deployments, and data access events, directly to the attackers.

This covert flow of information enables long-term surveillance and strategic lateral movement without triggering immediate alarms. Palo Alto Networks Unit 42 emphasized that the ramifications of these techniques range from a complete loss of visibility to covert persistence and data exfiltration. For example, stopping logging leads to total monitoring failure, while log redirection allows attackers to maintain ongoing, stealthy insight into victim environments.

What You Should Do

• Enforce Strict Access Controls: Implement the principle of least privilege for all logging resources. Critical permissions such as update-trail (AWS), logging.sinks.update (Google Cloud), and storage modification permissions (e.g., S3 bucket deletion) should be restricted to only the most highly privileged and trusted roles.
• Enable Integrity Validation: Activate integrity validation features offered by cloud providers, such as AWS CloudTrail log file validation, to detect any tampering with log files.
• Leverage Built-in Safeguards: Utilize cloud provider-specific protections. AWS provides a 90-day immutable event history for management actions, and Google Cloud offers system-created log buckets that cannot be altered or deleted. Be aware that these protections may not cover all custom logging configurations.
• Monitor Log Pipeline Access: Treat log pipelines as critical assets. Continuously monitor access to and changes in logging configurations, storage locations, and encryption keys.
• Implement Layered Defenses: Deploy a multi-layered security approach to ensure that even if one defense mechanism is compromised, others remain active to maintain visibility and prevent attacker persistence.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.