critical KQL AWS

CloudTrail Logging Stopped or Trail Deleted

Someone blinding the audit trail. One of the highest-signal cloud detections you can deploy - near-zero noise outside planned change windows.

Rule source

cloudtrail-logging-disabled.kql

// CloudTrail Logging Stopped or Trail Deleted
// T1562.008 - Impair Defenses: Disable or Modify Cloud Logs
// Near-zero false positives outside planned change windows.

AWSCloudTrail
| where EventName in ("StopLogging", "DeleteTrail", "UpdateTrail", "PutEventSelectors")
| where isempty(ErrorCode)
// Exclude the pipeline principal that legitimately manages trails
| where UserIdentityArn !has "role/terraform-cloudtrail-manager"
| extend Actor = coalesce(UserIdentityUserName, UserIdentityArn)
| extend TrailName = tostring(parse_json(RequestParameters).name)
| project
    TimeGenerated,
    EventName,
    Actor,
    TrailName,
    SourceIpAddress,
    UserAgent,
    AWSRegion
| order by TimeGenerated desc

Required telemetry

AWS CloudTrail management events

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Infrastructure-as-code rebuilds that recreate trails
Account decommissioning runbooks

Validation

Stack Set applied in a sandbox account; confirm the alert fires inside the ingestion SLA

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.