LoFP / backup, platform, or infrastructure-as-code teams may delete recovery points during retention cleanup, migration, or decommissioning. verify the principal in \"aws.cloudtrail.user_identity.arn\", the affected recovery point and vault in \"aws.cloudtrail.request_parameters\", and whether the deletion aligns with an approved change. known administration roles can be excluded after validation.

Techniques

• T1490

Sample rules

AWS Backup Recovery Point Deleted

• source: elastic
• technicques:
  • T1490

Description

Identifies deletion of an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by the AWS Backup service itself; deletion by a non-service principal is rare and should be reviewed.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: "DeleteRecoveryPoint"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"