TLDR Tech / InfoSec
Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility
In cloud environments, attackers often target cloud logging services to hamper defenders' visibility and establish passive monitoring. To hamper defenders' visibility, attackers can render logging ineffective by disabling logging, deleting the router or destination, encrypting logs with attacker-controlled keys, or poisoning logs by directly modifying their contents. Attackers can also establish passive visibility by configuring an additional log destination or redirecting logs to an attacker-controlled account.
Read the full story