Analytics BIOC
Informational
✕
AWS Backup vault was deleted
An AWS Backup vault was deleted by a cloud identity.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Inhibit System Recovery (T1490)
Detector tags: Cloud Data Asset Disaster Recovery Risks Cloud Data Asset Protection Tampering Data Detection & Response
Attacker's goals:
Destroy all backup data stored in the vault to prevent recovery after a ransomware or destructive attack. Deleting a vault is more impactful than deleting individual recovery points as it wipes all backups at once.
Investigative actions:
Confirm that the identity intended to delete this backup vault. Determine whether the vault contained recovery points for critical resources. Review further actions performed by the identity. Check whether other backup vaults or recovery points remain for the affected resources.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- AWS Backup vault was deleted from a production account Low (parent: Informational)
- AWS Backup vault was deleted for the first time by this identity Low (parent: Informational)