AWS Backup Recovery Point Deleted by Unusual User

  1[metadata]
  2creation_date = "2026/06/26"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/28"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies when an unusual user deletes an AWS Backup recovery point via DeleteRecoveryPoint. A recovery point is a
 11stored backup of a protected resource (EBS, RDS, DynamoDB, EFS, S3, and others). Deleting recovery points removes the
 12ability to restore the associated data and is a core anti-recovery technique used in ransomware and data-destruction
 13attacks to ensure victims cannot recover without paying or rebuilding. Routine lifecycle expirations are performed by
 14the AWS Backup service itself; deletion by a non-service principal is rare and should be reviewed. This is a New Terms
 15rule that uses "cloud.account.id", "user.name", and "aws.cloudtrail.flattened.request_parameters.backupVaultName" to 
 16alert on the first time a given identity in an account successfully deletes a recovery point from a specific backup vault 
 17within the history window.
 18"""
 19false_positives = [
 20    """
 21    Backup, platform, or infrastructure-as-code teams may delete recovery points during retention cleanup, migration, or
 22    decommissioning. Verify the principal in "aws.cloudtrail.user_identity.arn", the affected recovery point and vault
 23    in "aws.cloudtrail.request_parameters", and whether the deletion aligns with an approved change. Known
 24    administration roles can be excluded after validation.
 25    """,
 26]
 27from = "now-6m"
 28index = ["logs-aws.cloudtrail-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "AWS Backup Recovery Point Deleted by Unusual User"
 32note = """## Triage and analysis
 33
 34### Investigating AWS Backup Recovery Point Deleted by Unusual User
 35
 36AWS Backup recovery points are the restorable copies of protected resources. "DeleteRecoveryPoint" permanently removes a recovery point from its vault, eliminating the ability to restore that backup. Adversaries delete recovery points to inhibit recovery after data destruction or encryption, maximizing the impact of ransomware or sabotage. Because scheduled expirations are carried out by the AWS Backup service itself (excluded by this rule), a deletion by a user or role principal is uncommon and high-signal, especially when several recovery points are removed in a short window.
 37
 38This rule uses a New Terms approach to detect the first time a given identity in an account successfully deletes a recovery point from a specific backup vault.
 39
 40### Possible investigation steps
 41
 42- Identify the actor in "aws.cloudtrail.user_identity.arn" and "aws.cloudtrail.user_identity.type", and review "source.ip", "source.as.organization.name", and "user_agent.original" for an unexpected origin.
 43- Identify the affected recovery point and vault from "aws.cloudtrail.request_parameters" and "aws.cloudtrail.flattened.request_parameters.backupVaultName", and determine which resource and data it protected.
 44- Determine whether multiple recovery points or vaults were affected in the same window, indicating a broader anti-recovery effort.
 45- Correlate with adjacent destructive or evasion activity by the same principal, such as DeleteBackupVault, Vault Lock removal, KMS key deletion, or resource deletions.
 46
 47### False positive analysis
 48
 49- Retention cleanup, migration, or decommissioning may delete recovery points. Confirm the deletion is expected and exclude known administration roles on "aws.cloudtrail.user_identity.arn" after validation.
 50
 51### Response and remediation
 52
 53- If the deletion is unauthorized, treat it as a potential precursor to or part of a destructive attack: preserve remaining backups, enable Vault Lock where possible, and engage incident response.
 54- Rotate or restrict credentials for the principal if compromise is suspected, and restrict "backup:DeleteRecoveryPoint" to a small set of trusted administrators via IAM and SCPs.
 55"""
 56references = [
 57    "https://docs.aws.amazon.com/aws-backup/latest/devguide/API_DeleteRecoveryPoint.html",
 58    "https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html",
 59]
 60risk_score = 73
 61rule_id = "042b35f3-afa6-4441-92b2-ef41976b48a3"
 62setup = """This rule requires AWS CloudTrail management events for AWS Backup and ingestion via the Elastic AWS CloudTrail integration. See https://docs.elastic.co/integrations/aws/cloudtrail."""
 63severity = "high"
 64tags = [
 65    "Domain: Cloud",
 66    "Platform: AWS",
 67    "Data Source: AWS CloudTrail",
 68    "Service: AWS Backup",
 69    "Tactic: Impact",
 70    "Rule Type: New Terms",
 71    "Resources: Investigation Guide",
 72    "Noise: Low",
 73    "Performance: Fast",
 74    "Profile: Recommended",
 75    "Threat: Ransomware",
 76    "Rule Type: Custom Query (KQL)",
 77]
 78timestamp_override = "event.ingested"
 79type = "new_terms"
 80
 81query = '''
 82data_stream.dataset: "aws.cloudtrail"
 83    and event.provider: "backup.amazonaws.com"
 84    and event.action: "DeleteRecoveryPoint"
 85    and event.outcome: "success"
 86    and user.name: *
 87    and aws.cloudtrail.flattened.request_parameters.backupVaultName: *
 88    and not aws.cloudtrail.user_identity.type: "AWSService"
 89'''
 90
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1490"
 96name = "Inhibit System Recovery"
 97reference = "https://attack.mitre.org/techniques/T1490/"
 98
 99
100[rule.threat.tactic]
101id = "TA0040"
102name = "Impact"
103reference = "https://attack.mitre.org/tactics/TA0040/"
104
105[rule.investigation_fields]
106field_names = [
107    "@timestamp",
108    "user.name",
109    "user_agent.original",
110    "source.ip",
111    "source.as.number",
112    "source.as.organization.name",
113    "aws.cloudtrail.user_identity.arn",
114    "aws.cloudtrail.user_identity.type",
115    "aws.cloudtrail.user_identity.access_key_id",
116    "event.action",
117    "event.outcome",
118    "cloud.account.id",
119    "cloud.region",
120    "aws.cloudtrail.request_parameters",
121    "aws.cloudtrail.flattened.request_parameters.backupVaultName",
122    "aws.cloudtrail.response_elements",
123]
124
125[rule.new_terms]
126field = "new_terms_fields"
127value = ["cloud.account.id", "user.name", "aws.cloudtrail.flattened.request_parameters.backupVaultName"]
128[[rule.new_terms.history_window_start]]
129field = "history_window_start"
130value = "now-5d"