DeleteSnapshot

CSP: AWS

Tactics:

Impact

Techniques:

T1485

Tags:

AWS EC2

Event

Permanently deletes an EBS snapshot; any AMIs based on it must be deregistered first.

Security Context

• Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Impact

Techniques:

• T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...