DeleteObjects

AWS

DeleteObjects

service: AWS - S3

tactics:

Impact Defense Impairment

techniques:

T1485 T1685.002

tags:

AWS S3

Event

Deletes multiple S3 objects in a single batch request, more efficient than individual delete operations.

Security Context

Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

CloudTrail — DeleteObjects is an S3 object-level (data) event, which CloudTrail does not log by default. It is captured only if S3 data events are enabled for the bucket on the trail.

Sample Event

Adversarial. Draco issues a batch delete against the CloudTrail S3 bucket to drain it before he tries to delete the bucket itself. Three objects targeted (yesterday’s three log files for us-east-1). T1485 + T1685.002 (he’s clearing logs as a path to deleting the bucket).

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "IAMUser",
    "principalId": "AIDADRAC0MALF0YBADGY",
    "arn": "arn:aws:iam::555123456789:user/draco",
    "accountId": "555123456789",
    "accessKeyId": "ASIADRAC0MALF0YEXAMP5",
    "userName": "draco",
    "sessionContext": {
      "attributes": {
        "creationDate": "2026-04-15T19:02:11Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T20:46:33Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "DeleteObjects",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "[aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6]",
  "requestParameters": {
    "bucketName": "fantasticlogs-cloudtrail",
    "Host": "fantasticlogs-cloudtrail.s3.us-east-1.amazonaws.com",
    "delete": {
      "objects": [
        {
          "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1810Z_aBcDeFgHiJ.json.gz"
        },
        {
          "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1815Z_kLmNoPqRsT.json.gz"
        },
        {
          "key": "AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1820Z_uVwXyZ012345.json.gz"
        }
      ],
      "quiet": false
    }
  },
  "responseElements": null,
  "additionalEventData": {
    "SignatureVersion": "SigV4",
    "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "bytesTransferredIn": 612,
    "AuthenticationMethod": "AuthHeader",
    "bytesTransferredOut": 422
  },
  "requestID": "PXEXAMPLE456EFGH",
  "eventID": "90000000-0000-4000-8000-000011110101",
  "readOnly": false,
  "resources": [
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Bucket",
      "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail"
    },
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Object",
      "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1810Z_aBcDeFgHiJ.json.gz"
    },
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Object",
      "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1815Z_kLmNoPqRsT.json.gz"
    },
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Object",
      "ARN": "arn:aws:s3:::fantasticlogs-cloudtrail/AWSLogs/555123456789/CloudTrail/us-east-1/2026/04/14/555123456789_CloudTrail_us-east-1_20260414T1820Z_uVwXyZ012345.json.gz"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "555123456789",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "fantasticlogs-cloudtrail.s3.us-east-1.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Impact Defense Impairment

Techniques:

T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...
T1685.002 — Disable or Modify Cloud Log — An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within t...

DeleteObjects

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events