diff --git a/stories/aws_defense_evasion.yml b/stories/aws_defense_evasion.yml
new file mode 100644
index 0000000000..8b2f7ad5c7
--- /dev/null
+++ b/stories/aws_defense_evasion.yml
@@ -0,0 +1,25 @@
+name: AWS Defense Evasion
+id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9
+version: 1
+date: '2022-07-15'
+author: Gowthamaraj Rajendran, Splunk
+description: Looks for activities and techniques associated with the Evasion of
+  Defenses on AWS Environment, such as Disabling cloud trail, Deleting cloud trail and many others.
+narrative: Attackers employ a variety of tactics in order to avoid detection and operate
+  without barriers. This often involves modifying the configuration of security monitoring tools
+  to get around them or explicitly disabling them to prevent them from running. This
+  Analytic Story includes searches that look for activity consistent with attackers
+  attempting to disable various security mechanisms. Such activity may involve deleting the cloudtrail logs
+  , as this is where all the AWS logs get stored or explicitly changing the retention policy of s3 buckets.
+   Other times, attackers attempt deletion of a specified AWS CloudWatch log group.
+references:
+- https://attack.mitre.org/tactics/TA0005/
+tags:
+  analytic_story: AWS Defense Evasion
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring