Tag
critical
threat
AWS Account Closure Detected
1 rule 2 TTPsAdversaries or malicious insiders may close an AWS account using the `CloseAccount` API, a highly destructive action that suspends all access for 90 days before permanent termination, leading to data destruction and significant business disruption.
exploited
AWS account +1
cloud
aws
impact
data-destruction
account-access-removal
1r
2t
low
advisory
AWS IAM Group Deletion Detected
2 rules 1 TTPDetection of AWS IAM group deletion via the DeleteGroup API call, which may indicate an attacker removing audit trails, disrupting operations, or concealing privileged access activity.
IAM
aws
cloudtrail
impact
account-access-removal
2r
1t