DeleteAccessKey

CSP: AWS

Tactics:

Defense Evasion Impact

Techniques:

T1531T1562

Tags:

AWS IAM

Event

Permanently deletes an IAM user’s access key, revoking the associated programmatic access credentials.

Security Context

• Impairing defenses allows adversaries to operate freely by removing security controls that would otherwise detect or block their activity.
• Resource destruction eliminates data and services that may be difficult or impossible to recover, especially without adequate backups.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Defense Evasion Impact

Techniques:

• T1531 — Account Access Removal — Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.
• T1562 — Impair Defenses — Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms. This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify...