aws-cloudtrail-narrow-selectors

Principal with cloudtrail:PutEventSelectors can exclude attacker-used API principals, actions, or data-event prefixes from capture, creating selective audit blindness while leaving the trail apparently running.

derived aws emits CanModify

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?trail`
permissions	`cloudtrail:PutEventSelectors`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the principal holds cloudtrail:PutEventSelectors with no effective deny on the trail ARN scope; BLOCKED on SCP/boundary deny or member-account access to org trail.

source type

Identity

target type

LoggingService

source

?principal

target

?trail

permissions

cloudtrail:PutEventSelectors

conditions

iam_permission scp_or_org_policy

state logic

ACTIVE when the principal holds cloudtrail:PutEventSelectors with no effective deny on the trail ARN scope; BLOCKED on SCP/boundary deny or member-account access to org trail.

Narrative

{principal.name} can call cloudtrail:PutEventSelectors on {trail.name} to exclude specific API principals, resource types, or management event categories from capture. The trail remains apparently active (IsLogging=true), but targeted attacker actions avoid the audit record - a stealth evasion primitive.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-narrow-selectors
emits: CanModify
description: Principal with cloudtrail:PutEventSelectors can exclude attacker-used API principals, actions,
  or data-event prefixes from capture, creating selective audit blindness while leaving the trail apparently
  running.
match:
- - principal: null
  - HasPermission
  - trail: null
where:
- node_type(?trail) == LoggingService
- ?trail.provider_type == 'AWS::CloudTrail::Trail'
- effective_action(?principal, ?trail) includes 'cloudtrail:PutEventSelectors'
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?trail
  permissions:
  - cloudtrail:PutEventSelectors
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the principal holds cloudtrail:PutEventSelectors with no effective deny on
    the trail ARN scope; BLOCKED on SCP/boundary deny or member-account access to org trail.
  confidence: 0.9
  derived_from:
  - HasPermission(?principal, cloudtrail:PutEventSelectors, ?trail)
  false_positive_note: DEFENSE EVASION, NOT privilege escalation. Narrowing selectors via the PutEventSelectors
    API is the clean selector-exclusion surface. The trail remains in IsLogging=true state; monitoring
    that only checks trail status misses this. However, it grants zero resource access. Do NOT chain to
    any access edge. CanModify (resource_control/CONTROL) correctly describes the operational tamper capability.
  narrative: "{principal.name} can call cloudtrail:PutEventSelectors on {trail.name} to exclude specific\
    \ API principals, resource types, or management event categories from capture. The trail remains apparently\
    \ active (IsLogging=true), but targeted attacker actions avoid the audit record \u2014 a stealth evasion\
    \ primitive."