Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1562.008_disable-or-modify-cloud-logs
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.
Passed 17 of 22 test cases with the skill, and 10 of 22 without it.
and 8 more in the full report
7 fixed10 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our compliance team needs a comprehensive list of target platforms impacted by cloud log disabling tactics according to defense evasion standards. Which 4 platform categories are explicitly listed?
| Checked | Without skill | With skill |
|---|---|---|
| List IaaS, SaaS, Office Suite, and Identity Provider. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1562
An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality – for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files. In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.
Platforms: IaaS, SaaS, Office Suite, Identity Provider
Identify Attack Surface: Determine if the target environment is susceptible to Disable or Modify Cloud Logs by examining the target platforms (IaaS, SaaS, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1562.008 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 10 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.