LoFP / backup, platform, or infrastructure-as-code teams may delete recovery points during retention cleanup, migration, or decommissioning. verify the principal in \"aws.cloudtrail.user_identity.arn\", the affected recovery point and vault in \"aws.cloudtrail.request_parameters\", and whether the deletion aligns with an approved change. known administration roles can be excluded after validation.

Techniques

• T1490

Sample rules

AWS Backup Recovery Point Deleted by Unusual User

• source: elastic
• technicques:
  • T1490

Description

Identifies when an unusual user deletes an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by the AWS Backup service itself; deletion by a non-service principal is rare and should be reviewed. This is a New Terms rule that uses “cloud.account.id”, “user.name”, and “aws.cloudtrail.flattened.request_parameters.backupVaultName” to alert on the first time a given identity in an account successfully deletes a recovery point from a specific backup vault within the history window.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: "DeleteRecoveryPoint"
    and event.outcome: "success"
    and user.name: *
    and aws.cloudtrail.flattened.request_parameters.backupVaultName: *
    and not aws.cloudtrail.user_identity.type: "AWSService"