Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility

**Executive Summary:** This report analyzes attack techniques against cloud logging services (AWS CloudTrail and Google Cloud Logging), describing how adversaries can stop or redirect logs, delete storage or routers, tamper with encryption keys, and poison log files to evade detection or maintain continuous visibility, and it provides risk assessments and mitigations for defenders.