DeleteVolume
AWS
DeleteVolume
Event
Permanently deletes an EBS volume; the volume must be detached from any instance before deletion.
Security Context
- Destructive deletion of cloud resources can cause significant operational disruption, data loss, and extended recovery times.
Log Source
CloudTrail
Sample Event
Adversarial. Draco deletes the EBS root volume formerly attached to a now-terminated OCCAMY worker. Pure T1485 destructive impact, paired with prior DetachVolume and TerminateInstances calls that would have run before this.
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T19:02:11Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T21:09:42Z", "eventSource": "ec2.amazonaws.com", "eventName": "DeleteVolume", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "volumeId": "vol-0occamyworker0root1" }, "responseElements": { "requestId": "90000000-0000-4000-8000-000100001000", "_return": true }, "requestID": "90000000-0000-4000-8000-000100001000", "eventID": "90000000-0000-4000-8000-000100001001", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "555123456789", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "ec2.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Impact
Techniques:
- T1485 — Data Destruction — Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and r...