LoFP / platform or infrastructure-as-code teams may delete empty or deprecated vaults during decommissioning, or adjust vault lock during a planned governance change (note that compliance-mode locks cannot be removed). verify the principal in \"aws.cloudtrail.user_identity.arn\" and confirm the change aligns with an approved request. known administration roles can be excluded after validation.

Techniques

• T1490
• T1562

Sample rules

AWS Backup Vault Deleted or Vault Lock Removed

• source: elastic
• technicques:
  • T1490
  • T1562

Description

Identifies deletion of an AWS Backup vault or removal of its Vault Lock configuration via DeleteBackupVault or DeleteBackupVaultLockConfiguration. A backup vault stores recovery points, and Vault Lock enforces WORM (write-once, read-many) immutability that prevents recovery points from being deleted before their retention expires. Removing the lock defeats the primary control designed to stop ransomware from destroying backups, and deleting the vault removes the backup container entirely. Both actions are strong anti-recovery signals and are rare in normal operations.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: ("DeleteBackupVault" or "DeleteBackupVaultLockConfiguration")
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"