SC-109: Cloud Log Tampering & Anti-Forensics¶

Operation GHOST TRAIL¶

Scenario Metadata¶

Threat Actor Profile: SPECTRAL VOID¶

Executive Summary¶

SPECTRAL VOID compromises a cloud administrator's credentials at Meridian Financial Group (synthetic fintech company, 800 employees) through a targeted phishing campaign. Rather than immediately pursuing their financial objective, the attacker spends 9 days methodically disabling and deleting logging infrastructure across AWS, Azure, and GCP environments. They disable CloudTrail in 3 AWS regions, delete 47 VPC flow log configurations, modify Azure Diagnostic Settings to stop forwarding Activity Logs to the SIEM, and delete GCP audit log sinks. With forensic visibility eliminated, SPECTRAL VOID executes unauthorized wire transfers totaling $2.3M over 5 days. The attack is discovered on Day 23 when a finance team member notices discrepancies in reconciliation reports. The IR team finds a 14-day forensic blindspot with minimal recoverable evidence.

Environment Setup¶

Target Organization: Meridian Financial Group (synthetic)

Phase 1: Initial Access -- Credential Theft (Day 0)¶

Attacker Actions¶

SPECTRAL VOID sends a targeted phishing email to the cloud infrastructure team impersonating an AWS support notification about an upcoming service disruption:

From: aws-notifications@support-aws.example.com
To: cloud-admin@meridian.example.com
Subject: [Action Required] AWS Service Health -- Upcoming us-east-1 Maintenance

Dear Cloud Administrator,

A critical maintenance window is scheduled for your account 
111122223333. To avoid service disruption, please verify your 
administrative access:

https://console-aws.example.com/verify-access

This action must be completed within 24 hours.

Amazon Web Services Support

The cloud administrator (testuser/REDACTED) clicks the link and enters their AWS SSO credentials and MFA token on the phishing page. The attacker captures the session token and federated credentials providing access to AWS, Azure, and limited GCP resources.

Evidence Artifacts¶

{
  "eventTime": "2026-03-15T09:14:22Z",
  "eventName": "ConsoleLogin",
  "sourceIPAddress": "203.0.113.45",
  "userIdentity": {
    "type": "FederatedUser",
    "arn": "arn:aws:sts::111122223333:federated-user/cloud-admin",
    "accountId": "111122223333"
  },
  "responseElements": {
    "ConsoleLogin": "Success"
  },
  "additionalEventData": {
    "MFAUsed": "Yes",
    "LoginTo": "https://console.aws.example.com"
  }
}

Detection Queries¶

// Detect federated login from unusual IP
AWSCloudTrail
| where TimeGenerated > ago(24h)
| where EventName == "ConsoleLogin"
| where SourceIpAddress !startswith "10." 
    and SourceIpAddress !startswith "172.16."
    and SourceIpAddress !startswith "192.168."
| where UserIdentityType == "FederatedUser"
| join kind=leftanti (
    AWSCloudTrail
    | where TimeGenerated between(ago(30d) .. ago(1d))
    | where EventName == "ConsoleLogin"
    | distinct SourceIpAddress
) on SourceIpAddress
| project TimeGenerated, UserIdentityArn, SourceIpAddress, 
    AWSRegion

index=aws sourcetype=aws:cloudtrail eventName=ConsoleLogin
| search sourceIPAddress!="10.*" sourceIPAddress!="172.16.*"
| stats earliest(_time) as first_seen values(userIdentity.arn) 
    as user by sourceIPAddress
| where first_seen > relative_time(now(), "-24h")
| lookup known_admin_ips ip as sourceIPAddress OUTPUT is_known
| where isnull(is_known)

Discussion Injects¶

Phase 2: Privilege Escalation & Persistence (Days 1-3)¶

Attacker Actions¶

SPECTRAL VOID creates a backdoor IAM user and additional access keys:

{
  "eventTime": "2026-03-16T02:33:41Z",
  "eventName": "CreateUser",
  "sourceIPAddress": "203.0.113.45",
  "requestParameters": {
    "userName": "svc-cloudwatch-metrics"
  },
  "userIdentity": {
    "arn": "arn:aws:sts::111122223333:federated-user/cloud-admin"
  }
}

{
  "eventTime": "2026-03-16T02:34:02Z",
  "eventName": "AttachUserPolicy",
  "requestParameters": {
    "userName": "svc-cloudwatch-metrics",
    "policyArn": "arn:aws:iam::111122223333:policy/AdminAccess-Legacy"
  }
}

The attacker creates the user name svc-cloudwatch-metrics to blend in with legitimate service accounts. They attach an existing overly-permissive legacy policy rather than creating a new one to avoid triggering alerts on policy creation.

Detection Queries¶

// Detect IAM user creation outside of IaC pipelines
AWSCloudTrail
| where EventName in ("CreateUser", "CreateAccessKey", 
    "AttachUserPolicy")
| where UserIdentityArn !has "terraform" 
    and UserIdentityArn !has "cloudformation"
| summarize Actions=make_set(EventName), 
    ActionCount=count() by UserIdentityArn, 
    bin(TimeGenerated, 1h)
| where ActionCount >= 2

index=aws sourcetype=aws:cloudtrail 
    eventName IN ("CreateUser", "CreateAccessKey", 
    "AttachUserPolicy")
| search NOT userIdentity.arn="*terraform*" 
    NOT userIdentity.arn="*cloudformation*"
| stats values(eventName) as actions count by 
    userIdentity.arn span=1h _time
| where count >= 2

Phase 3: Log Infrastructure Destruction (Days 4-9)¶

Attacker Actions¶

This is the core of the operation. SPECTRAL VOID systematically eliminates forensic evidence across all cloud platforms over 6 days, spacing actions to avoid triggering volume-based alerts.

Day 4 -- AWS CloudTrail Disabled¶

{
  "eventTime": "2026-03-19T03:15:44Z",
  "eventName": "StopLogging",
  "sourceIPAddress": "198.51.100.22",
  "requestParameters": {
    "name": "arn:aws:cloudtrail:us-east-1:111122223333:trail/meridian-prod-trail"
  }
}

{
  "eventTime": "2026-03-19T04:22:18Z",
  "eventName": "StopLogging",
  "sourceIPAddress": "198.51.100.22",
  "requestParameters": {
    "name": "arn:aws:cloudtrail:us-west-2:111122223333:trail/meridian-prod-trail"
  }
}

{
  "eventTime": "2026-03-19T05:01:33Z",
  "eventName": "StopLogging",
  "sourceIPAddress": "198.51.100.22",
  "requestParameters": {
    "name": "arn:aws:cloudtrail:eu-west-1:111122223333:trail/meridian-prod-trail"
  }
}

Day 5 -- VPC Flow Logs Deleted¶

The attacker deletes flow log configurations across 47 VPCs and subnets:

{
  "eventTime": "2026-03-20T01:44:12Z",
  "eventName": "DeleteFlowLogs",
  "sourceIPAddress": "198.51.100.22",
  "requestParameters": {
    "DeleteFlowLogIds": [
      "fl-0a1b2c3d4e5f6a7b8",
      "fl-1b2c3d4e5f6a7b8c9",
      "fl-2c3d4e5f6a7b8c9d0"
    ]
  }
}

Day 6 -- S3 Log Bucket Lifecycle Policy Modified¶

Rather than deleting existing logs (which would trigger data loss alerts), the attacker modifies the S3 lifecycle policy to expire objects after 1 day:

{
  "eventTime": "2026-03-21T02:11:55Z",
  "eventName": "PutBucketLifecycleConfiguration",
  "sourceIPAddress": "198.51.100.22",
  "requestParameters": {
    "bucketName": "meridian-cloudtrail-logs",
    "lifecycleConfiguration": {
      "rules": [{
        "id": "log-retention-compliance",
        "status": "Enabled",
        "expiration": { "days": 1 },
        "prefix": ""
      }]
    }
  }
}

Day 7 -- Azure Diagnostic Settings Removed¶

{
  "time": "2026-03-22T03:05:27Z",
  "operationName": "MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/DELETE",
  "caller": "cloud-admin@meridian.example.com",
  "callerIpAddress": "198.51.100.22",
  "properties": {
    "statusCode": "OK",
    "resourceUri": "/subscriptions/aaaabbbb-cccc-dddd-eeee-ffffgggghhhh/providers/microsoft.insights/diagnosticSettings/send-to-sentinel"
  }
}

Day 8-9 -- GCP Audit Log Sinks Deleted¶

{
  "timestamp": "2026-03-23T04:18:33Z",
  "protoPayload": {
    "methodName": "google.logging.v2.ConfigServiceV2.DeleteSink",
    "authenticationInfo": {
      "principalEmail": "cloud-admin@meridian.example.com"
    },
    "requestMetadata": {
      "callerIp": "198.51.100.22"
    },
    "request": {
      "sinkName": "projects/meridian-gcp-prod/sinks/export-to-splunk"
    }
  }
}

Detection Queries¶

// CRITICAL: Detect CloudTrail being disabled
AWSCloudTrail
| where EventName in ("StopLogging", "DeleteTrail", 
    "UpdateTrail", "DeleteFlowLogs",
    "PutBucketLifecycleConfiguration")
| project TimeGenerated, EventName, SourceIpAddress, 
    UserIdentityArn, RequestParameters
| order by TimeGenerated asc

index=aws sourcetype=aws:cloudtrail 
    eventName IN ("StopLogging", "DeleteTrail", 
    "UpdateTrail", "DeleteFlowLogs", 
    "PutBucketLifecycleConfiguration")
| table _time eventName sourceIPAddress 
    userIdentity.arn requestParameters
| sort _time

Discussion Injects¶

Phase 4: Financial Fraud Execution (Days 10-14)¶

Attacker Actions¶

With logging disabled, SPECTRAL VOID executes the primary objective -- unauthorized wire transfers through the internal payment API:

2026-03-25T06:12:44Z POST /api/v2/transfers/initiate
Source: 198.51.100.22 (via VPN tunnel to 10.20.5.50)
Auth: Bearer token (svc-cloudwatch-metrics)
Body: {
  "from_account": "MFG-OPERATING-001",
  "to_account": "EXT-8847291",
  "amount": 487000.00,
  "currency": "USD",
  "reference": "Q1-VENDOR-SETTLEMENT-0847"
}
Response: 200 OK -- Transfer ID: TXN-20260325-0847

2026-03-26T05:44:18Z POST /api/v2/transfers/initiate
Source: 198.51.100.22
Body: {
  "from_account": "MFG-OPERATING-001",
  "to_account": "EXT-9912034",
  "amount": 523000.00,
  "currency": "USD",
  "reference": "Q1-VENDOR-SETTLEMENT-0912"
}
Response: 200 OK -- Transfer ID: TXN-20260326-0912

Total unauthorized transfers: 5 transactions, $2.3M over 5 days, all using legitimate-looking vendor settlement reference numbers.

Evidence Artifacts¶

[2026-03-25T06:12:44Z] [payments-api] [INFO] Transfer initiated
  user=svc-cloudwatch-metrics src=10.20.3.17 
  amount=487000.00 dest=EXT-8847291
[2026-03-25T06:12:45Z] [payments-api] [INFO] Transfer approved
  txn=TXN-20260325-0847 approval=auto 
  (amount < threshold 500000)

Phase 5: Discovery & Response (Day 23)¶

Discovery¶

A finance team member notices $2.3M in unreconciled outbound transfers during monthly close. The transfers reference vendor settlement codes that do not match any active vendor agreements.

IR Team Findings¶

The incident response team discovers:

1. CloudTrail disabled in all 3 AWS regions since Day 4
2. VPC flow logs deleted -- no network traffic records for 19 days
3. Azure Diagnostic Settings removed -- no Activity Log forwarding since Day 7
4. GCP log export sinks deleted since Day 8
5. S3 log bucket lifecycle policy set to 1-day expiration -- historical logs destroyed
6. A backdoor IAM user (svc-cloudwatch-metrics) with admin privileges

Timeline Reconstruction¶

Indicators of Compromise¶

Network IOCs¶

Cloud IOCs¶

Behavioral IOCs¶

Containment & Remediation¶

Immediate Actions (Hour 0-4)¶

1. Re-enable CloudTrail in all regions immediately
2. Restore VPC flow logs across all VPCs and subnets
3. Restore Azure Diagnostic Settings and GCP log sinks
4. Disable backdoor IAM user svc-cloudwatch-metrics and revoke all access keys
5. Rotate cloud-admin credentials -- revoke all sessions, issue new FIDO2 keys
6. Freeze external wire transfers pending investigation
7. Restore S3 lifecycle policy to original retention (365 days)

Evidence Recovery¶

Preventive Controls¶

1. CloudTrail tamper protection -- Enable organization-level trail with SCP preventing StopLogging/DeleteTrail
2. Log immutability -- S3 Object Lock (Governance or Compliance mode) on all log buckets
3. Cross-account log archival -- Ship logs to a separate security account with restricted access
4. Real-time alerting on log infrastructure changes -- StopLogging, DeleteFlowLogs, and diagnostic setting deletion must page the SOC immediately
5. Phishing-resistant MFA -- FIDO2/WebAuthn for all cloud administrator accounts
6. Wire transfer controls -- Dual-approval for all external transfers regardless of amount
7. Service account governance -- All service accounts require owner, expiration date, and principle of least privilege

Detection Improvements¶

// CRITICAL ALERT: Any modification to logging infrastructure
let LogTamperEvents = dynamic([
    "StopLogging", "DeleteTrail", "UpdateTrail",
    "DeleteFlowLogs", "PutBucketLifecycleConfiguration"
]);
AWSCloudTrail
| where EventName in (LogTamperEvents)
| extend AlertSeverity = "Critical"
| project TimeGenerated, EventName, SourceIpAddress,
    UserIdentityArn, AWSRegion, RequestParameters

index=aws sourcetype=aws:cloudtrail 
    eventName IN ("StopLogging", "DeleteTrail", 
    "UpdateTrail", "DeleteFlowLogs",
    "PutBucketLifecycleConfiguration")
| eval alert_severity="critical"
| sendalert cloud_log_tampering
| table _time eventName sourceIPAddress 
    userIdentity.arn awsRegion

ATT&CK Mapping¶

Lessons Learned¶

1. CloudTrail StopLogging is the single most critical alert in AWS -- If you detect nothing else, detect this. The StopLogging event is the last event before total blindness. Real-time paging is mandatory.
2. Log immutability is non-negotiable -- S3 Object Lock in Compliance mode prevents even root accounts from deleting logs. Without it, attackers can erase all evidence of their activity.
3. Cross-account log archival creates a forensic safety net -- Logs shipped to a separate security account survive even if the production account is fully compromised.
4. Anti-forensics extends dwell time dramatically -- The 14-day blindspot turned what could have been a 4-day incident into a 23-day incident with $2.3M in losses.
5. Financial structuring defeats single-threshold controls -- The attacker kept every transfer below $500K. Velocity-based detection (multiple transfers in a short window) would have caught this pattern.

Cross-References¶

• Chapter 20: Cloud Attack & Defense -- Cloud-specific attack patterns and detection
• Chapter 9: Incident Response Lifecycle -- IR methodology for cloud environments
• Chapter 57: Cloud Forensics -- Cloud forensic evidence collection and preservation