AWS CloudTrail Important Change (4db60cc0-36fb-42b7-9b58-a5b53019fb74)

Detects disabling, deleting and updating of a Trail

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
AWS CloudTrail Important Change (4db60cc0-36fb-42b7-9b58-a5b53019fb74)	Sigma-Rules	Disable or Modify Cloud Log - T1685.002 (34ff60a3-a3f8-42e4-bed0-af9a2cb563d7)	Attack Pattern	1
Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872)	Attack Pattern	Disable or Modify Cloud Log - T1685.002 (34ff60a3-a3f8-42e4-bed0-af9a2cb563d7)	Attack Pattern	2