Threat actors are increasingly exploiting Google Cloud Logging and AWS CloudTrail to evade detection and maintain unauthorized visibility into victim environments. Attack techniques include disabling logging, deleting logs, modifying encryption keys to render logs unreadable, log poisoning through S3/Cloud Storage permissions, and redirecting logs to attacker-controlled destinations. While organizations often assume logs are protected, these logging services lack uniform protection enforcement, enabling attackers to blind security monitoring and enable long-term reconnaissance. Defenders are advised to enforce strict access controls on logging APIs, enable log integrity validation and bucket locking, and implement continuous monitoring of logging configuration changes.
- Hackers Exploit AWS CloudTrail and Google Cloud Logging to Hide (opens in a new tab)
- Attackers Exploit Cloud Logging Platforms to Hide Malicious Acti(opens in a new tab)