DisassociateMembers

CSP: AWS

Tactics:

Defense Evasion

Techniques:

T1562.001

Tags:

AWS GuardDuty

Event

Disassociates specified member accounts from a GuardDuty administrator account.

Security Context

• Disabling security monitoring tools eliminates visibility into adversary activity, allowing subsequent attack stages to proceed undetected.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Defense Evasion

Techniques:

• T1562.001 — Disable or Modify Tools — Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properl...