AWS ChangePassword
Changes the calling IAM user’s console password.
Impact
Impact
Section titled “Impact”The adversary is trying to manipulate, interrupt, or destroy your systems and data.
Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Techniques used for impact can include destroying or tampering with data. In some cases, business processes can look fine, but may have been altered to benefit the adversaries’ goals. These techniques might be used by adversaries to follow through on their end goal or to provide cover for a confidentiality breach.
In cloud environments, impact techniques include deleting critical resources (databases, storage, compute instances), encrypting data for ransom, modifying DNS records, or disrupting services by changing security configurations. Adversaries may also terminate instances, delete backups, or exhaust service quotas to cause denial of service.
View Impact on MITRE ATT&CK →Events Related to Impact
Section titled “Events Related to Impact”Explore this tactic in the map.
AWS DeleteAccessKey
Deletes an IAM access key permanently.
AWS DeleteBucket
Deletes an empty S3 bucket, after all object versions and delete markers are removed.
AWS DeleteDBCluster
Deletes an RDS DB cluster with configurable final-snapshot and backup handling.
AWS DeleteDBInstance
Deletes an RDS DB instance with configurable final-snapshot and backup handling.
AWS DeleteFileSystem
Deletes an EFS file system after mount-target and replication prerequisites are satisfied.
AWS DeleteGlobalCluster
Deletes an empty Aurora global-database container after regional members are detached or deleted.
AWS DeleteLoginProfile
Deletes the target user’s AWS console password without deleting access keys.
AWS DeleteObject
Deletes an S3 object or a specified version, depending on versioning state.
AWS DeleteObjects
Requests deletion of multiple S3 object keys or specific versions in one batch.
AWS DeleteSnapshot
Deletes an EBS snapshot, subject to protection and retention controls.
AWS DeleteUser
Deletes an IAM user after dependent credentials and associations are removed.
AWS DeleteVolume
Deletes an available EBS volume without deleting its snapshots.
AWS DisableKey
Disables a KMS key for cryptographic operations until re-enabled.
GCP google.iam.admin.v1.DeleteServiceAccount
Deletes a service account, potentially disrupting dependent workloads.
Azure Microsoft.Authorization/locks/delete
Deletes an Azure management lock.
Azure Microsoft.Authorization/roleAssignments/delete
Deletes an Azure RBAC role assignment.
Azure Microsoft.Compute/virtualMachines/delete
Requests deletion of an Azure virtual machine.
Azure Microsoft.EventHub/namespaces/eventhubs/delete
Deletes an Event Hub entity within an Azure Event Hubs namespace.
Azure Microsoft.KeyVault/vaults/delete
Deletes an Azure Key Vault resource, subject to recovery and purge controls.
Azure Microsoft.KeyVault/vaults/secrets/delete
Deletes a named Key Vault secret and all its versions.
Azure Microsoft.OperationalInsights/workspaces/delete
Deletes an Azure Log Analytics workspace, with optional permanent deletion.
Azure Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete
Requests removal of protection and backup data for an Azure Backup protected item.
Azure Microsoft.Sql/servers/databases/delete
Deletes an Azure SQL Database while recovery depends on retained backups.
Azure Microsoft.Storage/storageAccounts/blobServices/containers/delete
Deletes an Azure Blob Storage container through the management plane.
Azure Microsoft.Storage/storageAccounts/delete
Deletes an Azure Storage account and makes its services unavailable.
Azure Microsoft.Storage/storageAccounts/regenerateKey/action
Regenerates a selected Azure Storage account access key.
AWS PutBucketLifecycle
Creates or replaces S3 lifecycle rules for expiration and storage management.
AWS PutBucketLifecycleConfiguration
Creates or replaces an S3 bucket lifecycle configuration.
AWS RemoveUserFromGroup
Removes an IAM user from a group, changing the policies that apply to the user.
AWS ScheduleKeyDeletion
Schedules KMS key deletion and makes the pending key unavailable for cryptographic operations.
GCP secretmanager.secrets.delete
Deletes a Secret Manager secret and all its versions.
GCP SecretManagerService.DestroySecretVersion
Destroys or schedules destruction of a Secret Manager secret version.
GCP storage.buckets.delete
Deletes a Cloud Storage bucket, subject to contents and soft-delete policy.
GCP storage.objects.delete
Deletes a Cloud Storage object or a specified object generation.
AWS TerminateInstances
Terminates EC2 instances, with storage impact determined by their configuration.
AWS UpdateAccessKey
Sets an IAM access key to Active or Inactive.
AWS UpdateLoginProfile
Updates an IAM user console password or password-reset requirement.