Attackers Can Blind Cloud Logging to Hide and Spy on Your AWS and GCP Environments
Palo Alto Networks identifies seven ways attackers can corrupt AWS CloudTrail and Google Cloud Logging, either to hide their activity or siphon logs for continuous surveillance. The techniques prove that compromising logging services can give threat actors persistent, undetected access, forcing defenders to harden the very tools they rely on for detection.