T1685.002 — Disable or Modify Cloud Log

Tactic: Defense Impairment · Platforms: IaaS, SaaS, Identity Provider, Office Suite

An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within…

Sub-technique of Disable or Modify Tools (T1685).

Sigma detection rules (4)

title: "T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log"
id: 15948c31-71c3-4f67-bb4c-8fe387e8a527
description: 'Detection Strategy for Disable or Modify Cloud Log. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AdminRoles, RegionScope.'
references:
  - https://attack.mitre.org/techniques/T1685/002
author: Shahrukh Khan
date: 2026-04-02
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.002

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'config.amazonaws.com'
    eventName:
      - 'StopConfigurationRecorder'
      - 'DeleteConfigRule'
      - 'DeleteDeliveryChannel'

  condition: selection

falsepositives:
  - Planned decommissioning of an AWS Config recorder during account closure or migration to a replacement compliance tool.

level: high

title: "T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log"
id: 4361b516-6660-4ad7-a778-59be6a7fe962
description: 'Detection Strategy for Disable or Modify Cloud Log. (Data Component: Cloud Service Disable; baseline tier: fallback.) Tune using: IntegrationScope.'
references:
  - https://attack.mitre.org/techniques/T1685/002
author: Shahrukh Khan
date: 2026-02-16
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.002

logsource:
  product: saas
  service: audit

detection:
  selection:
    event_type:
      - 'audit_logging_disabled'
      - 'log_retention_changed'
      - 'log_export_disabled'

  condition: selection

falsepositives:
  - A planned retention or log-forwarding configuration change made by compliance or platform-admin staff during a scheduled review; field names vary by vendor since this is a generic audit-console log.

level: critical

title: "T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log"
id: 1fad04b0-9633-4233-8bba-367ac9967485
description: 'Detection Strategy for Disable or Modify Cloud Log. (Data Component: Cloud Service Modification; baseline tier: fallback.) Tune using: CriticalAccounts.'
references:
  - https://attack.mitre.org/techniques/T1685/002
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.002

logsource:
  product: azure
  service: policy

detection:
  selection:
    OperationName:
      - 'Update conditional access policy'
      - 'Delete conditional access policy'
  selection_priv:
    OperationName: 'Update user'
  condition: selection or selection_priv

falsepositives:
  - Identity team performing planned Conditional Access policy updates that temporarily affect privileged break glass accounts.

level: high

title: "T1685.002 Disable or Modify Tools: Disable or Modify Cloud Log"
id: cb04dd60-3e9c-4973-ba33-e6e389ff908f
description: 'Detection Strategy for Disable or Modify Cloud Log. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: UserScope.'
references:
  - https://attack.mitre.org/techniques/T1685/002
author: Shahrukh Khan
date: 2026-05-21
license: MIT
tags:
  - attack.defense-impairment
  - attack.t1685.002

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Set-User'
      - 'Update user'
    Parameters.Name: 'BlockCredential'
    Parameters.Value: 'True'

  condition: selection

falsepositives:
  - Help desk staff legitimately disabling a departing user account as part of standard offboarding.

level: high

Related sub-techniques

• T1685.005 Clear Windows Event Logs
• T1685.003 Modify or Spoof Tool UI
• T1685.006 Clear Linux or Mac System Logs
• T1685.001 Disable or Modify Windows Event Log
• T1685.004 Disable or Modify Linux Audit System Log

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1685.002 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan