Threat Actors may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If Threat Actors has sufficient permissions, they can disable or modify logging to avoid detection of their activities.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.