Analytics Low
✕

Suspicious EBS snapshots deletion

An identity deleted multiple EBS snapshots from the project, considerably more than usual.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Impact (TA0040)
ATT&CK techniques: Inhibit System Recovery (T1490)
Attacker's goals:

Adversaries may delete data to prevent the recovery of a corrupted system.

Investigative actions:

Identify the deleted snapshots and their associated resources. Investigate the identity that performed the deletion and review recent related activity.

Test period:
1 Hour
Deduplication:
5 Days
1 variation:
  • A non administrative identity successfully deleted multiple snapshots from a project Medium (parent: Low)