DeleteObjects
AWS
DeleteObjects
Event
Deletes multiple S3 objects in a single batch request, more efficient than individual delete operations.
Security Context
- Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.
Log Source
CloudTrail
Sample Event
Adversarial. Draco issues a batch delete against the CloudTrail S3 bucket to drain it before he tries to delete the bucket itself. Three objects targeted (yesterday’s three log files for us-east-1). T1485 + T1685.002 (he’s clearing logs as a path to deleting the bucket).
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T19:02:11Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T20:46:33Z", "eventSource": "s3.amazonaws.com", "eventName": "DeleteObjects", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "[aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6]", "requestParameters": { "bucketName": "fantasticlogs-cloudtrail", "Host": "fantasticlogs-cloudtrail.s3.us-east-1.amazonaws.com", "delete": { "objects": [ { "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1810Z_aBcDeFgHiJ.json.gz" }, { "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1815Z_kLmNoPqRsT.json.gz" }, { "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1820Z_uVwXyZ012345.json.gz" } ], "quiet": false } }, "responseElements": null, "additionalEventData": { "SignatureVersion": "SigV4", "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "bytesTransferredIn": 612, "AuthenticationMethod": "AuthHeader", "bytesTransferredOut": 422 }, "requestID": "PXEXAMPLE456EFGH", "eventID": "90000000-0000-4000-8000-000011110101", "readOnly": false, "resources": [ { "accountId": "555123456789", "type": "AWS::S3::Bucket", "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail" }, { "accountId": "555123456789", "type": "AWS::S3::Object", "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1810Z_aBcDeFgHiJ.json.gz" }, { "accountId": "555123456789", "type": "AWS::S3::Object", "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1815Z_kLmNoPqRsT.json.gz" }, { "accountId": "555123456789", "type": "AWS::S3::Object", "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1820Z_uVwXyZ012345.json.gz" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "555123456789", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "fantasticlogs-cloudtrail.s3.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...