Cloud logging services like AWS CloudTrail and Google Cloud Logging have become the backbone of enterprise security monitoring, but that same criticality makes them a prime target.
Research from Palo Alto Networks’ Unit 42 team reveals how sophisticated threat actors are actively exploiting these services to blind security teams, redirect sensitive log data, and establish covert, long-term visibility inside victim environments.
Attacks against cloud logging infrastructure fall into two strategic categories: defense evasion, where attackers disrupt log flows to avoid detection, and continuous visibility, where they silently redirect logs to attacker-controlled destinations for ongoing intelligence gathering.
Leverage Cloud Logs to Bypass Defender Visibility
Unit 42 identified distinct techniques across both categories, targeting AWS CloudTrail and Google Cloud Logging.
Stop Logging is the most direct approach. An attacker with cloudtrail:StopLogging permissions in AWS or logging.sinks.update in Google Cloud, you can immediately halt log delivery, creating an instant blind spot for SOARs, SIEMs, and CSPM tools that depend on continuous log ingestion.
Deleting Log Storage Destinations takes a more destructive path. Attackers with s3:DeleteBucket permissions can remove the S3 bucket receiving CloudTrail logs entirely, wiping forensic evidence and disabling future logging simultaneously.
Google Cloud offers partial protection here deleted log buckets enter a seven-day DELETE_REQUESTED state before permanent removal, giving defenders a narrow response window.
Deleting Log Routers — AWS trails or Google Cloud sinks achieve a similar result without touching storage, making it a subtler disruption to the security pipeline.
Encryption Key Manipulation is among the more advanced techniques. Attackers create an external KMS key, update the CloudTrail trail to use it, then revoke access, rendering logs unwritable and unreadable without leaving obvious deletion artifacts.
The same attack is possible in Google Cloud using customer-managed encryption keys (CMEK).
Log Poisoning targets already-written logs stored in S3 or Cloud Storage. Attackers with read/write permissions on objects can download, modify, and re-upload log files in JSON format, thereby corrupting the audit trail that SOC analysts rely on for incident investigation.
Rather than destroying logs, these techniques redirect them. Configuring a new log routing resource, such as a rogue CloudTrail trail or a new Google Cloud sink, sends a copy of all logs to an attacker-controlled bucket, giving adversaries real-time visibility into IAM changes, VM deployments, and sensitive data access without touching existing infrastructure.
Log Redirection modifies the destination of existing trails or sinks, silently rerouting the entire log stream to attacker infrastructure.
This technique carries the highest likelihood of malicious activity rating in Unit 42’s risk assessment and enables continuous passive discovery while the victim’s security tooling detects nothing.
Organizations should restrict modification permissions for logging resources to highly privileged users only. AWS accounts benefit from an immutable 90-day CloudTrail Event History for management events as a fallback.
According to paloaltonetworks research, Google Cloud’s _Required log bucket provides similar protection for Admin Activity and System Event logs, which cannot be disabled or deleted.
Additional hardening steps include enabling CloudTrail log file integrity validation, locking Google Cloud log buckets to prevent deletion, and configuring EventBridge alerts on CreateTrail and UpdateTrail API calls.
As Unit 42 notes, the integrity of the logging infrastructure itself is now a critical security control, and organizations that fail to protect it risk handing adversaries an invisible window into their cloud environments.
CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”
