Cloud instance deletion attempt

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure: Delete Cloud Instance (T1578.003)
Severity	Informational

Description

An attempt was made to delete a cloud compute instance.

Attacker's Goals

To remove evidence or disrupt operations.

Investigative actions

• Review recent activity associated with the identity and the deleted instance.

Variations

Cloud instance deletion attempt using Cloud Formation or Terraform

Synopsis

Field	Value
ATT&CK Tactic	Defense Impairment (TA0112)
ATT&CK Technique	Modify Cloud Compute Infrastructure: Delete Cloud Instance (T1578.003)
Severity	Informational

Description

An attempt was made to delete a cloud compute instance.

Attacker's Goals

To remove evidence or disrupt operations.

Investigative actions

• Review recent activity associated with the identity and the deleted instance.