Evading Logging in the Cloud Disrupting and Bypassing AWS CloudTrail

Why Attackers Target CloudTrail

Nick Rhoades explains CloudTrail as AWS’s fundamental API audit log answering who did what when—valuable for detection, threat hunting, and automation. From an adversary view, disabling or evading CloudTrail hides cloud actions after foothold.

Disrupting CloudTrail Logging

Rhoades covers post-compromise options to disable or impede logging at account-level trail configurations, including real incidents where attackers attempted to blind defenders. Default CloudTrail runs without custom setup, but misconfigured or centralized logging gaps leave organizations exposed if supporting infrastructure fails.

Bypassing CloudTrail Internals

The core research maps AWS API internals to vulnerabilities that allowed actions without CloudTrail records—from permission enumeration flaws to direct service interactions. AWS has since fixed disclosed issues; Rhoades argues defenders should study bypass patterns to harden multi-account organization trails, integrity validation, and encryption rather than assuming SIEM ingestion alone suffices.