Elastic high stable kql

AWS Backup Recovery Point Deleted

Identifies deletion of an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction attacks to ensure victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by the AWS Backup service itself; deletion by a non-service principal is rare and should be reviewed.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: "DeleteRecoveryPoint"
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.type: "AWSService"

False Positives

⚠ Backup, platform, or infrastructure-as-code teams may delete recovery points during retention cleanup, migration, or decommissioning. Verify the principal in "aws.cloudtrail.user_identity.arn", the affected recovery point and vault in "aws.cloudtrail.request_parameters", and whether the deletion aligns with an approved change. Known administration roles can be excluded after validation.

Field Validations

Loading…

Comments (0)

Loading comments...