Cloud storage automatic backup disabled

Cortex XDR Analytics Alert Reference by Alert name

Product: Cortex XDR
Last date published: 2025-02-14
Category: Analytics Alert Reference
Index by: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

Automatic backup of a cloud storage resource was disabled.

Attacker's Goals

Impair built-in protection of the cloud environment.
This action may be a preliminary action before deleting the cloud resource itself.

Investigative actions

Confirm that the identity intended to disable automatic backup on this resource.
Follow further actions done by the identity.
Monitor this resource for other suspicious activities.

Variations

Cloud storage automatic backup disabled from a CLI

Synopsis

ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

Automatic backup of a cloud storage resource was disabled from a CLI.

Attacker's Goals

Impair built-in protection of the cloud environment.
This action may be a preliminary action before deleting the cloud resource itself.

Investigative actions

Confirm that the identity intended to disable automatic backup on this resource.
Follow further actions done by the identity.
Monitor this resource for other suspicious activities.