AWS Backup recovery point deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

An attempt was made to delete an AWS Backup recovery point.

Attacker's Goals

Adversaries may delete backup recovery points to prevent system recovery after compromise.

Investigative actions

• Identify the deleted recovery point and its associated resource.
• Investigate the identity that performed the deletion and review recent related activity.