aws-cloudtrail-redirect-delivery

Principal with cloudtrail:UpdateTrail can redirect S3 log delivery to an attacker-controlled bucket, enabling silent log exfiltration while the trail remains IsLogging=true. This is a log-redirect-to-attacker-bucket exfiltration capability, distinct from selector narrowing.

derived aws emits CanWrite

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'trail': None}

where

node_type(?trail) == LoggingService ?trail.provider_type == 'AWS::CloudTrail::Trail' effective_action(?principal, ?trail) includes 'cloudtrail:UpdateTrail' policy_allows_parameter_modification(?principal, 'S3BucketName') OR policy_allows_parameter_modification(?principal, 'S3KeyPrefix')

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?trail`
permissions	`cloudtrail:UpdateTrail`
conditions	`iam_permission` `scp_or_org_policy`
state logic	ACTIVE when the principal holds cloudtrail:UpdateTrail with no effective deny AND the IAM policy permits changes to S3BucketName or S3KeyPrefix (detected via policy analysis or confirmation from analyst annotation). This capability allows silent redirection of CloudTrail logs to an attacker-controlled bucket; logs continue to be generated (IsLogging=true) but flow to the attacker. BLOCKED on SCP/boundary deny or policy condition keys that restrict bucket changes.

Narrative

{principal.name} can call cloudtrail:UpdateTrail on {trail.name} to redirect log delivery to a different S3 bucket (via S3BucketName parameter), potentially an attacker-controlled bucket. Logs continue to be recorded (IsLogging=true remains), but flow to the attacker, enabling silent exfiltration of the audit trail. This is an anti-forensic / cover-tracks + data-exfiltration primitive.

Raw rule rules/derived/aws/cloudtrail.yaml

id: aws-cloudtrail-redirect-delivery
emits: CanWrite
description: Principal with cloudtrail:UpdateTrail can redirect S3 log delivery to an attacker-controlled
  bucket, enabling silent log exfiltration while the trail remains IsLogging=true. This is a log-redirect-to-attacker-bucket
  exfiltration capability, distinct from selector narrowing.
match:
- - principal: null
  - HasPermission
  - trail: null
where:
- node_type(?trail) == LoggingService
- ?trail.provider_type == 'AWS::CloudTrail::Trail'
- effective_action(?principal, ?trail) includes 'cloudtrail:UpdateTrail'
- policy_allows_parameter_modification(?principal, 'S3BucketName') OR policy_allows_parameter_modification(?principal,
  'S3KeyPrefix')
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?trail
  permissions:
  - cloudtrail:UpdateTrail
  conditions:
  - iam_permission
  - scp_or_org_policy
  state_logic: ACTIVE when the principal holds cloudtrail:UpdateTrail with no effective deny AND the IAM
    policy permits changes to S3BucketName or S3KeyPrefix (detected via policy analysis or confirmation
    from analyst annotation). This capability allows silent redirection of CloudTrail logs to an attacker-controlled
    bucket; logs continue to be generated (IsLogging=true) but flow to the attacker. BLOCKED on SCP/boundary
    deny or policy condition keys that restrict bucket changes.
  confidence: 0.85
  derived_from:
  - HasPermission(?principal, cloudtrail:UpdateTrail, ?trail)
  false_positive_note: "This rule fires on UpdateTrail when the policy permits S3 bucket/prefix changes.\
    \ If UpdateTrail is locked to safe parameters only (e.g., via IAM condition keys limiting resource\
    \ scope), this rule should not emit. Analysts should verify that the target bucket redirection is\
    \ actually exploitable before promoting the edge to ACTIVE. This is distinct from selector narrowing\
    \ (evasion) and is an exfiltration primitive \u2014 do NOT chain to CanExecuteAs."
  narrative: '{principal.name} can call cloudtrail:UpdateTrail on {trail.name} to redirect log delivery
    to a different S3 bucket (via S3BucketName parameter), potentially an attacker-controlled bucket.
    Logs continue to be recorded (IsLogging=true remains), but flow to the attacker, enabling silent exfiltration
    of the audit trail. This is an anti-forensic / cover-tracks + data-exfiltration primitive.'