Product
high
advisory
AWS Security Services Impairment via Deletion of Resources
2 rules 1 TTPDetection of adversaries attempting to impair or disable AWS security services by deleting resources across GuardDuty, AWS WAF, CloudWatch, Route 53, and CloudWatch Logs to evade detection and remove visibility.
CloudWatch +5
aws
cloudtrail
defense-evasion
cloud
2r
1t
high
advisory
AWS Security Services Configuration Deletion
2 rules 1 TTPDetection of deletion of critical AWS Security Services configurations like CloudWatch alarms, GuardDuty detectors, and Web Application Firewall rules to evade detection, potentially leading to data breaches and unauthorized access.
CloudWatch +5
aws
cloudtrail
defense-evasion
security-service
2r
1t
medium
advisory
AWS CloudWatch Alarm Deletion for Defense Evasion
2 rules 2 TTPsSuccessful deletion of Amazon CloudWatch alarms via the `DeleteAlarms` API, potentially indicating an adversary attempting to impair visibility, silence alerts, and evade detection after malicious activity within an AWS environment.
CloudWatch
defense-evasion
aws
2r
2t