Disable cloud logging

Info

ID: MS-TA7017
Tactic: Defense Evasion
MITRE technique: T1562.008

Attackers with appropriate permissions may disable or alter cloud logging to hide their actions and avoid detection. This can include turning off diagnostic logging on a web application, deleting or modifying existing log data, changing log retention policies to accelerate log expiration, or redirecting log output. By suppressing logging, the attacker reduces the visibility that defenders have into ongoing malicious activity, making it harder to detect the compromise, perform incident response, or reconstruct the attack timeline.

Mitigations

ID	Mitigation	Description
MS-M7029	Restrict logging configuration permissions	Use policies to prevent unauthorized modification or deletion of logging settings across cloud platforms.
MS-M7030	Centralize logs to protected accounts	Send logs to separate, restricted accounts or projects where application identities cannot modify or delete them.