AWS EBS snapshot deletion

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

An attempt was made to delete an EBS snapshot.

Attacker's Goals

Adversaries may delete data to prevent the recovery of a corrupted system.

Investigative actions

• Identify the deleted snapshot and its associated resource.
• Investigate the identity that performed the deletion and review recent related activity.