Cloud storage delete protection disabled

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2024-12-03
Category: Analytics Alert Reference
Order: data source

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

Delete protection of a cloud storage resource was disabled.

Attacker's Goals

Impair built-in protection of the cloud environment.
This action may be a preliminary action before deleting the cloud resource itself.

Investigative actions

Confirm that the identity intended to disable deletion protection on this resource.
Follow further actions done by the identity.
Monitor this resource for other suspicious activities.

Variations

Cloud storage delete protection disabled by an unusual identity

Synopsis

ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490)
Severity	Informational

Description

Delete protection of a cloud storage resource was disabled by an unusual identity.

Attacker's Goals

Impair built-in protection of the cloud environment.
This action may be a preliminary action before deleting the cloud resource itself.

Investigative actions

Confirm that the identity intended to disable deletion protection on this resource.
Follow further actions done by the identity.
Monitor this resource for other suspicious activities.