Skip to content
TheCloud.Events

Explore

One catalog. Two ways to explore.

Find the evidence you’re looking for.

Explore adversary behavior in the map, or look up an API in the event list. Your filters follow you between views.

262catalog events
41techniques
12tactics
Cloud providers

Explore tactics

Select a tactic to focus the map

250 events · 41 techniques · 12 tactics

01

Initial Access

TA0001

The adversary is trying to get into your network.

7 events
T1078.004

Cloud Accounts

7 events AWS
Technique context
AWS AssumeRoleAWS - STS AWS AssumeRoleWithSAMLAWS - STS AWS AssumeRoleWithWebIdentityAWS - STS AWS ConsoleLoginAWS - SignIn AWS GetAuthorizationTokenAWS - ECR AWS GetFederationTokenAWS - STS AWS GetSessionTokenAWS - STS
02

Execution

TA0002

The adversary is trying to run malicious code.

13 events
T1651

Cloud Administration Command

6 events AWSAzure
Technique context
AWS CreateAssociationAWS - SSM Azure Microsoft.Compute/virtualMachines/extensions/writeAzure - Compute Azure Microsoft.Compute/virtualMachines/runCommand/actionAzure - Compute AWS ResumeSessionAWS - SSM AWS SendCommandAWS - SSM AWS StartSessionAWS - SSM
T1059

Command and Scripting Interpreter

5 events AWSAzure
Technique context
Azure Microsoft.Compute/virtualMachines/runCommand/actionAzure - Compute Azure Microsoft.ContainerService/managedClusters/runCommand/actionAzure - AKS AWS ModifyInstanceAttributeAWS - EC2 AWS SendCommandAWS - SSM AWS StartBuildAWS - CodeBuild
T1072

Software Deployment Tools

3 events AWSAzure
Technique context
AWS CreateStackAWS - CloudFormation Azure Microsoft.Automation/automationAccounts/jobs/writeAzure - Automation Azure Microsoft.Automation/automationAccounts/runbooks/writeAzure - Automation
T1053

Scheduled Task/Job

1 event AWS
Technique context
AWS CreateAssociationAWS - SSM
T1648

Serverless Execution

1 event AWS
Technique context
AWS InvokeAWS - Lambda
03

Persistence

TA0003

The adversary is trying to maintain their foothold.

77 events
T1098

Account Manipulation

32 events AWSAzureGCP
Technique context
Azure Add Owner To ApplicationAzure - Microsoft Entra ID Azure Add Owner To GroupAzure - Microsoft Entra ID AWS AddPermission20150331v2AWS - Lambda AWS AddRoleToInstanceProfileAWS - IAM AWS AddUserToGroupAWS - IAM Azure Admin Registered Security InfoAzure - Microsoft Entra ID AWS AttachGroupPolicyAWS - IAM AWS AttachRolePolicyAWS - IAM AWS AttachUserPolicyAWS - IAM AWS ChangePasswordAWS - IAM Azure Consent To ApplicationAzure - Microsoft Entra ID AWS CreateAccessEntryAWS - EKS AWS CreatePolicyAWS - IAM AWS CreatePolicyVersionAWS - IAM AWS DeleteRolePolicyAWS - IAM AWS DeleteUserPolicyAWS - IAM AWS DetachRolePolicyAWS - IAM AWS DetachUserPolicyAWS - IAM GCP EnableServiceAccountGCP - IAM GCP iam.roles.updateGCP - IAM Azure Microsoft.KeyVault/vaults/accessPolicies/writeAzure - Key Vault Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionAzure - Managed Identity AWS PutGroupPolicyAWS - IAM AWS PutRolePolicyAWS - IAM AWS PutUserPolicyAWS - IAM Azure Reset User PasswordAzure - Microsoft Entra ID AWS SetDefaultPolicyVersionAWS - IAM Azure Update User Authentication MethodsAzure - Microsoft Entra ID AWS UpdateAccessKeyAWS - IAM AWS UpdateAssumeRolePolicyAWS - IAM AWS UpdateFunctionConfiguration20150331v2AWS - Lambda AWS UpdateLoginProfileAWS - IAM
T1098.003

Additional Cloud Roles

12 events AWSAzureGCP
Technique context
Azure Add App Role Assignment To Service PrincipalAzure - Microsoft Entra ID Azure Add Eligible Member To Role In Pim CompletedAzure - Microsoft Entra ID Azure Add Member To RoleAzure - Microsoft Entra ID Azure Add Role Definition (Azure RBAC)Azure - Authorization GCP add-iam-policy-bindingGCP - IAM GCP compute.disks.setIamPolicyGCP - Compute Engine AWS CreateRoleAWS - IAM GCP google.iam.admin.v1.SetIAMPolicyGCP - IAM Azure Microsoft.Authorization/roleAssignments/writeAzure - Authorization Azure Microsoft.Directory/groups/members/updateAzure - Microsoft Entra ID GCP storage.setIamPermissionsGCP - Cloud Storage Azure Update Role Definition (Azure RBAC)Azure - Authorization
T1098.001

Additional Cloud Credentials

7 events AWSAzureGCP
Technique context
Azure Add Federated Identity CredentialAzure - Microsoft Entra ID AWS CreateAccessKeyAWS - IAM AWS CreateLoginProfileAWS - IAM GCP google.iam.admin.v1.CreateServiceAccountKeyGCP - IAM GCP google.iam.admin.v1.UploadServiceAccountKeyGCP - IAM Azure Microsoft.Directory/servicePrincipals/credentials/updateAzure - Microsoft Entra ID GCP storage.hmacKeys.createGCP - Cloud Storage
T1098.004

SSH Authorized Keys

6 events AWSGCP
Technique context
GCP compute.instances.setMetadataGCP - Compute Engine GCP compute.projects.setCommonInstanceMetadataGCP - Compute Engine AWS CreateKeyPairAWS - EC2 AWS ImportKeyPairAWS - EC2 GCP users.importSshPublicKeyGCP - OS Login GCP users.sshPublicKeys.patchGCP - OS Login
T1136.003

Cloud Account

6 events AWSAzure
Technique context
Azure Add ApplicationAzure - Microsoft Entra ID Azure Add Service PrincipalAzure - Microsoft Entra ID Azure Add UserAzure - Microsoft Entra ID AWS CreateAccountAWS - Organizations AWS CreateUserAWS - IAM Azure Invite External UserAzure - Microsoft Entra ID
T1546

Event Triggered Execution

4 events AWSAzure
Technique context
Azure Microsoft.Automation/automationAccounts/webhooks/writeAzure - Automation AWS PutRuleAWS - EventBridge AWS PutTargetsAWS - EventBridge AWS UpdateFunctionCode20150331v2AWS - Lambda
T1556.006

Multi-Factor Authentication

4 events AWSAzure
Technique context
Azure Admin Registered Security InfoAzure - Microsoft Entra ID AWS DeleteVirtualMFADeviceAWS - IAM Azure Disable Strong AuthenticationAzure - Microsoft Entra ID Azure Update User Authentication MethodsAzure - Microsoft Entra ID
T1078.004

Cloud Accounts

3 events AWS
Technique context
AWS GetAuthorizationTokenAWS - ECR AWS GetFederationTokenAWS - STS AWS GetSessionTokenAWS - STS
T1556

Modify Authentication Process

2 events AWS
Technique context
AWS CreateOpenIDConnectProviderAWS - IAM AWS CreateSAMLProviderAWS - IAM
T1053

Scheduled Task/Job

1 event AWS
Technique context
AWS CreateAssociationAWS - SSM
T1098.005

Device Registration

1 event AWS
Technique context
AWS CreateVirtualMFADeviceAWS - IAM
T1525

Implant Internal Image

1 event AWS
Technique context
AWS PutImageAWS - ECR
04

Privilege Escalation

TA0004

The adversary is trying to gain higher-level permissions.

70 events
T1098

Account Manipulation

32 events AWSAzureGCP
Technique context
Azure Add Owner To ApplicationAzure - Microsoft Entra ID Azure Add Owner To GroupAzure - Microsoft Entra ID AWS AddPermission20150331v2AWS - Lambda AWS AddRoleToInstanceProfileAWS - IAM AWS AddUserToGroupAWS - IAM AWS AssociateIamInstanceProfileAWS - EC2 AWS AttachGroupPolicyAWS - IAM AWS AttachRolePolicyAWS - IAM AWS AttachUserPolicyAWS - IAM GCP compute.instances.setServiceAccountGCP - Compute Engine Azure Consent To ApplicationAzure - Microsoft Entra ID AWS CreateAccessEntryAWS - EKS AWS CreateDevEndpointAWS - Glue AWS CreatePolicyAWS - IAM AWS CreatePolicyVersionAWS - IAM AWS DeleteRolePolicyAWS - IAM AWS DeleteUserPolicyAWS - IAM AWS DetachRolePolicyAWS - IAM AWS DetachUserPolicyAWS - IAM GCP EnableServiceAccountGCP - IAM GCP iam.roles.updateGCP - IAM Azure Microsoft.KeyVault/vaults/accessPolicies/writeAzure - Key Vault Azure Microsoft.ManagedIdentity/userAssignedIdentities/assign/actionAzure - Managed Identity AWS PutGroupPolicyAWS - IAM AWS PutKeyPolicyAWS - KMS AWS PutRolePolicyAWS - IAM AWS PutUserPolicyAWS - IAM AWS ReplaceIamInstanceProfileAssociationAWS - EC2 AWS SetDefaultPolicyVersionAWS - IAM AWS UpdateAssumeRolePolicyAWS - IAM AWS UpdateDevEndpointAWS - Glue AWS UpdateFunctionConfiguration20150331v2AWS - Lambda
T1098.003

Additional Cloud Roles

14 events AWSAzureGCP
Technique context
Azure Add App Role Assignment To Service PrincipalAzure - Microsoft Entra ID Azure Add Eligible Member To Role In Pim CompletedAzure - Microsoft Entra ID Azure Add Member To RoleAzure - Microsoft Entra ID Azure Add Role Definition (Azure RBAC)Azure - Authorization GCP add-iam-policy-bindingGCP - IAM GCP compute.disks.setIamPolicyGCP - Compute Engine AWS CreateRoleAWS - IAM AWS CreateServiceLinkedRoleAWS - IAM GCP google.iam.admin.v1.SetIAMPolicyGCP - IAM Azure Microsoft.Authorization/elevateAccess/actionAzure - Authorization Azure Microsoft.Authorization/roleAssignments/writeAzure - Authorization Azure Microsoft.Directory/groups/members/updateAzure - Microsoft Entra ID GCP storage.setIamPermissionsGCP - Cloud Storage Azure Update Role Definition (Azure RBAC)Azure - Authorization
T1078.004

Cloud Accounts

6 events AWS
Technique context
AWS AssumeRoleAWS - STS AWS AssumeRoleWithSAMLAWS - STS AWS AssumeRoleWithWebIdentityAWS - STS AWS GetAuthorizationTokenAWS - ECR AWS GetFederationTokenAWS - STS AWS GetSessionTokenAWS - STS
T1548

Abuse Elevation Control Mechanism

5 events AWS
Technique context
AWS DeleteRolePermissionsBoundaryAWS - IAM AWS DeleteUserPermissionsBoundaryAWS - IAM AWS PassRoleAWS - IAM AWS PutRolePermissionsBoundaryAWS - IAM AWS PutUserPermissionsBoundaryAWS - IAM
T1098.001

Additional Cloud Credentials

4 events AWSAzureGCP
Technique context
AWS CreateAccessKeyAWS - IAM AWS CreateLoginProfileAWS - IAM GCP google.iam.admin.v1.CreateServiceAccountKeyGCP - IAM Azure Microsoft.Directory/servicePrincipals/credentials/updateAzure - Microsoft Entra ID
T1548.005

Temporary Elevated Cloud Access

4 events GCP
Technique context
GCP generateAccessTokenGCP - IAM GCP iam.serviceAccounts.actAsGCP - IAM GCP iam.serviceAccounts.implicitDelegationGCP - IAM GCP iam.serviceAccounts.signJwtGCP - IAM
T1484.002

Trust Modification

3 events AWS
Technique context
AWS CreateOpenIDConnectProviderAWS - IAM AWS CreateSAMLProviderAWS - IAM AWS UpdateAssumeRolePolicyAWS - IAM
T1098.004

SSH Authorized Keys

2 events AWS
Technique context
AWS CreateKeyPairAWS - EC2 AWS ImportKeyPairAWS - EC2
T1098.005

Device Registration

1 event AWS
Technique context
AWS CreateVirtualMFADeviceAWS - IAM
05

Stealth

TA0005

The adversary is trying to hide and conceal their actions, appearing as normal behavior.

9 events
T1078.004

Cloud Accounts

7 events AWS
Technique context
AWS AssumeRoleAWS - STS AWS AssumeRoleWithSAMLAWS - STS AWS AssumeRoleWithWebIdentityAWS - STS AWS ConsoleLoginAWS - SignIn AWS GetAuthorizationTokenAWS - ECR AWS GetFederationTokenAWS - STS AWS GetSessionTokenAWS - STS
T1070

Indicator Removal

1 event GCP
Technique context
GCP google.iam.admin.v1.DeleteServiceAccountKeyGCP - IAM
T1535

Unused/Unsupported Cloud Regions

1 event AWS
Technique context
AWS EnableRegionAWS - Account Management
06

Defense Impairment

TA0112

The adversary is trying to break security mechanisms, pipelines, and tooling so defenders can’t see or trust what’s happening.

73 events
T1685

Disable or Modify Tools

27 events AWSAzureGCP
Technique context
AWS ArchiveFindingsAWS - GuardDuty AWS CreateFilterAWS - GuardDuty AWS CreateIPSetAWS - GuardDuty AWS DeleteAlarmsAWS - CloudWatch AWS DeleteConfigRuleAWS - Config AWS DeleteConfigurationRecorderAWS - Config AWS DeleteDeliveryChannelAWS - Config AWS DeleteDetectorAWS - GuardDuty AWS DeleteMembersAWS - GuardDuty AWS DisassociateFromMasterAccountAWS - GuardDuty AWS DisassociateMembersAWS - GuardDuty GCP google.cloud.securitycenter.v1.SecurityCenter.SetMuteGCP - Security Command Center AWS LeaveOrganizationAWS - Organizations Azure Microsoft.HybridCompute/machines/extensions/deleteAzure - Azure Arc Azure Microsoft.Insights/activityLogAlerts/deleteAzure - Monitor Azure Microsoft.Insights/metricAlerts/deleteAzure - Monitor Azure Microsoft.Security/alertsSuppressionRules/writeAzure - Microsoft Defender for Cloud Azure Microsoft.Security/autoProvisioningSettings/writeAzure - Microsoft Defender for Cloud Azure Microsoft.Security/pricings/writeAzure - Microsoft Defender for Cloud Azure Microsoft.Security/securitySolutions/deleteAzure - Microsoft Defender for Cloud AWS RemoveAccountFromOrganizationAWS - Organizations AWS ScheduleKeyDeletionAWS - KMS GCP SecurityCenter.UpdateOrganizationSettings (deprecated)GCP - Security Command Center AWS StopConfigurationRecorderAWS - Config AWS StopMonitoringMembersAWS - GuardDuty AWS UpdateDetectorAWS - GuardDuty AWS UpdateIPSetAWS - GuardDuty
T1685.002

Disable or Modify Cloud Log

21 events AWSAzureGCP
Technique context
AWS DeleteBucketAWS - S3 AWS DeleteEventDataStoreAWS - CloudTrail AWS DeleteFlowLogsAWS - EC2 AWS DeleteLogGroupAWS - CloudWatchLogs AWS DeleteLogStreamAWS - CloudWatchLogs AWS DeleteObjectsAWS - S3 AWS DeleteTrailAWS - CloudTrail GCP google.logging.v2.ConfigServiceV2.UpdateExclusionGCP - Cloud Logging GCP google.logging.v2.LoggingServiceV2.DeleteLogGCP - Cloud Logging GCP logging.projects.exclusions.createGCP - Cloud Logging GCP logging.sinks.deleteGCP - Cloud Logging GCP logging.sinks.updateGCP - Cloud Logging Azure Microsoft.EventHub/namespaces/eventhubs/deleteAzure - Event Hubs Azure Microsoft.Insights/diagnosticSettings/deleteAzure - Monitor Azure Microsoft.Network/networkWatchers/flowLogs/deleteAzure - Network Watcher Azure Microsoft.OperationalInsights/workspaces/deleteAzure - Log Analytics AWS PutBucketLifecycleConfigurationAWS - S3 AWS PutEventSelectorsAWS - CloudTrail AWS StopLoggingAWS - CloudTrail Azure Storage Analytics logging disabledAzure - Azure Storage AWS UpdateTrailAWS - CloudTrail
T1686.001

Cloud Firewall

14 events AWSAzureGCP
Technique context
AWS AuthorizeDBSecurityGroupIngressAWS - RDS AWS AuthorizeSecurityGroupEgressAWS - EC2 AWS AuthorizeSecurityGroupIngressAWS - EC2 GCP compute.firewalls.deleteGCP - Compute Engine GCP compute.firewalls.patchGCP - Compute Engine AWS CreateNetworkAclEntryAWS - EC2 AWS DeleteNetworkAclAWS - EC2 AWS DeleteNetworkAclEntryAWS - EC2 AWS DeleteRuleGroupAWS - WAFV2 AWS DeleteWebACLAWS - WAFV2 Azure Microsoft.Network/networkSecurityGroups/deleteAzure - Network Security Group Azure Microsoft.Network/networkSecurityGroups/securityRules/writeAzure - Network Security Group AWS ModifyDBInstanceAWS - RDS Azure VaultPatchAzure - Azure Key Vault
T1484.002

Trust Modification

3 events AWS
Technique context
AWS CreateOpenIDConnectProviderAWS - IAM AWS CreateSAMLProviderAWS - IAM AWS UpdateAssumeRolePolicyAWS - IAM
T1556.006

Multi-Factor Authentication

3 events AWSAzure
Technique context
AWS DeactivateMFADeviceAWS - IAM AWS DeleteVirtualMFADeviceAWS - IAM Azure Update User Authentication MethodsAzure - Microsoft Entra ID
T1556

Modify Authentication Process

2 events AWS
Technique context
AWS CreateOpenIDConnectProviderAWS - IAM AWS CreateSAMLProviderAWS - IAM
T1556.009

Conditional Access Policies

2 events Azure
Technique context
Azure Update Conditional Access PolicyAzure - Microsoft Entra ID Azure Update named locationAzure - Conditional Access, Named Locations
T1578

Modify Cloud Compute Infrastructure

1 event AWS
Technique context
AWS ModifyInstanceAttributeAWS - EC2
T1578.003

Delete Cloud Instance

1 event Azure
Technique context
Azure Microsoft.Compute/virtualMachines/deleteAzure - Compute
T1599

Network Boundary Bridging

1 event Azure
Technique context
Azure Microsoft.Network/virtualNetworks/virtualNetworkPeerings/writeAzure - Network
07

Credential Access

TA0006

The adversary is trying to steal account names and passwords.

16 events
T1552

Unsecured Credentials

11 events AWSAzure
Technique context
AWS GetPasswordDataAWS - EC2 Azure Microsoft.AppConfiguration/configurationStores/listKeys/actionAzure - App Configuration Azure Microsoft.Batch/batchAccounts/listKeys/actionAzure - Batch Azure Microsoft.ContainerRegistry/registries/listCredentials/actionAzure - Container Registry Azure Microsoft.ContainerService/managedClusters/listClusterAdminCredential/actionAzure - Container Service Azure Microsoft.ContainerService/managedClusters/listClusterUserCredential/actionAzure - Container Service Azure Microsoft.OperationalInsights/workspaces/sharedKeys/actionAzure - Log Analytics Azure Microsoft.ServiceBus/namespaces/authorizationRules/listKeys/actionAzure - Service Bus Azure Microsoft.Storage/storageAccounts/listKeys/actionAzure - Azure Storage Azure Microsoft.Storage/storageAccounts/regenerateKey/actionAzure - Azure Storage Azure Microsoft.Web/sites/host/listKeys/actionAzure - Web
T1555.006

Cloud Secrets Management Stores

4 events AWSAzureGCP
Technique context
AWS GetParametersAWS - SSM AWS GetSecretValueAWS - SecretsManager Azure Microsoft.KeyVault/vaults/secrets/readAzure - Key Vault GCP SecretManagerService.AccessSecretVersionGCP - Secret Manager
T1528

Steal Application Access Token

1 event Azure
Technique context
Azure Consent To ApplicationAzure - Microsoft Entra ID
08

Discovery

TA0007

The adversary is trying to figure out your environment.

0 events
09

Lateral Movement

TA0008

The adversary is trying to move through your environment.

10 events
T1021

Remote Services

4 events AWSAzure
Technique context
AWS EnableSerialConsoleAccessAWS - EC2 Azure Microsoft.SerialConsole/serialPorts/connect/actionAzure - Compute AWS ResumeSessionAWS - SSM AWS StartSessionAWS - SSM
T1021.004

SSH

3 events AWSGCP
Technique context
GCP google.ssh-serialport.v1.connectGCP - SSH Serial Port AWS SendSerialConsoleSSHPublicKeyAWS - EC2InstanceConnect AWS SendSSHPublicKeyAWS - EC2InstanceConnect
T1550.001

Application Access Token

3 events AWS
Technique context
AWS AssumeRoleAWS - STS AWS AssumeRoleWithSAMLAWS - STS AWS AssumeRoleWithWebIdentityAWS - STS
10

Collection

TA0009

The adversary is trying to gather data of interest to their goal.

17 events
T1530

Data from Cloud Storage

14 events AWSAzure
Technique context
Azure CopyBlobAzure - Azure Blob Storage AWS CopyObjectAWS - S3 AWS CreateDBSnapshotAWS - RDS AWS CreateImageAWS - EC2 AWS CreateInstanceExportTaskAWS - EC2 AWS CreateSnapshotAWS - EC2 AWS DeleteBucketPolicyAWS - S3 AWS GetObjectAWS - S3 Azure Microsoft.Compute/disks/beginGetAccess/actionAzure - Compute Azure Microsoft.Compute/snapshots/beginGetAccess/actionAzure - Compute AWS PutBucketAclAWS - S3 AWS PutBucketPublicAccessBlockAWS - S3 AWS RestoreDBInstanceFromDBSnapshotAWS - RDS AWS StartExportTaskAWS - RDS
T1213.006

Databases

3 events AzureGCP
Technique context
GCP bigquery.jobs.insertGCP - BigQuery GCP cloudsql.instances.exportGCP - Cloud SQL Azure Microsoft.Sql/servers/databases/export/actionAzure - Azure SQL
11

Exfiltration

TA0010

The adversary is trying to steal data.

13 events
T1537

Transfer Data to Cloud Account

13 events AWSAzureGCP
Technique context
GCP bigquery.jobs.insertGCP - BigQuery GCP cloudsql.instances.exportGCP - Cloud SQL Azure CopyBlobAzure - Azure Blob Storage AWS CopyObjectAWS - S3 Azure Microsoft.Sql/servers/databases/export/actionAzure - Azure SQL AWS ModifyDBSnapshotAttributeAWS - RDS AWS ModifyImageAttributeAWS - EC2 AWS ModifySnapshotAttributeAWS - EC2 AWS PutBucketPolicyAWS - S3 AWS PutBucketReplicationAWS - S3 AWS SharedSnapshotCopyInitiatedAWS - EC2 AWS SharedSnapshotVolumeCreatedAWS - EC2 AWS StartExportTaskAWS - RDS
12

Impact

TA0040

The adversary is trying to manipulate, interrupt, or destroy your systems and data.

38 events
T1485

Data Destruction

27 events AWSAzureGCP
Technique context
AWS DeleteBucketAWS - S3 AWS DeleteDBClusterAWS - RDS AWS DeleteDBInstanceAWS - RDS AWS DeleteFileSystemAWS - elasticfilesystem AWS DeleteGlobalClusterAWS - RDS AWS DeleteObjectAWS - S3 AWS DeleteObjectsAWS - S3 AWS DeleteSnapshotAWS - EC2 AWS DeleteVolumeAWS - EC2 Azure Microsoft.Authorization/locks/deleteAzure - Authorization Azure Microsoft.Compute/virtualMachines/deleteAzure - Compute Azure Microsoft.EventHub/namespaces/eventhubs/deleteAzure - Event Hubs Azure Microsoft.KeyVault/vaults/deleteAzure - Key Vault Azure Microsoft.KeyVault/vaults/secrets/deleteAzure - Key Vault Azure Microsoft.OperationalInsights/workspaces/deleteAzure - Log Analytics Azure Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/deleteAzure - Backup Azure Microsoft.Sql/servers/databases/deleteAzure - Azure SQL Azure Microsoft.Storage/storageAccounts/blobServices/containers/deleteAzure - Azure Storage Azure Microsoft.Storage/storageAccounts/deleteAzure - Azure Storage AWS PutBucketLifecycleAWS - S3 AWS PutBucketLifecycleConfigurationAWS - S3 AWS ScheduleKeyDeletionAWS - KMS GCP secretmanager.secrets.deleteGCP - Secret Manager GCP SecretManagerService.DestroySecretVersionGCP - Secret Manager GCP storage.buckets.deleteGCP - Cloud Storage GCP storage.objects.deleteGCP - Cloud Storage AWS TerminateInstancesAWS - EC2
T1531

Account Access Removal

10 events AWSAzureGCP
Technique context
AWS ChangePasswordAWS - IAM AWS DeleteAccessKeyAWS - IAM AWS DeleteLoginProfileAWS - IAM AWS DeleteUserAWS - IAM GCP google.iam.admin.v1.DeleteServiceAccountGCP - IAM Azure Microsoft.Authorization/roleAssignments/deleteAzure - Authorization Azure Microsoft.Storage/storageAccounts/regenerateKey/actionAzure - Azure Storage AWS RemoveUserFromGroupAWS - IAM AWS UpdateAccessKeyAWS - IAM AWS UpdateLoginProfileAWS - IAM
T1490

Inhibit System Recovery

3 events AWSAzure
Technique context
AWS DeleteSnapshotAWS - EC2 Azure Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/deleteAzure - Backup AWS PutBucketLifecycleAWS - S3
T1489

Service Stop

1 event AWS
Technique context
AWS DisableKeyAWS - KMS