The CloudTrail APIs attackers use instead of StopLogging

Preview text: Most detections watch the obvious APIs. Capable attackers don't use them.

Tuesday, Mar 31, 2026 at 1:48 PM EasternKlaviyo

Abstract SecurityThe CloudTrail APIs attackers use instead of StopLogging

Image not available

No image available for this email.

Subject: The CloudTrail APIs attackers use instead of StopLogging
Preview text: Most detections watch the obvious APIs. Capable attackers don't use them.
From: gallery@abstract.security
Brand: Abstract Security
ESP: Klaviyo
Sent: Tue Mar 31, 2026, 1:48 PM ET
Size: 43 KB
Images: 5
Links: 7, 2 of them buttons
Subject length: 56 characters

Against Abstract Security's usual

Sent in the 1 PM hour, which holds 12% of its emails; 20% arrive in the 12 PM hour. The subject is 56 characters; its average is 51.

	May 28, 2026 12:34 PM	Free SIEM Reversibility Audit (before your next renewal)
	May 19, 2026 9:45 AM	Claude Code has broader access than most IAM roles.
	May 6, 2026 12:54 PM	MFA Isn't Everything: The Latest from ASTRO
	Apr 21, 2026 2:58 PM	Webinar Alert: Uncovering Access Broker Trends
	Apr 14, 2026 12:42 PM	Inside the initial access broker market (Apr 22)
	Mar 31, 2026 1:48 PM	The CloudTrail APIs attackers use instead of StopLogging (this email)
	Mar 17, 2026 12:13 PM	Join Us Tomorrow: SIEM is a State of Mind 🔆