attack.t1562.008

AWS GuardDuty Detector Deleted Or Updated

Nov 28, 2025 · attack.defense-evasion attack.t1562.001 attack.t1562.008 ·

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.

AWS CloudTrail Important Change

Aug 14, 2025 · attack.defense-evasion attack.t1562.008 ·

Share on:

Detects disabling, deleting and updating of a Trail

AWS Config Disabling Channel/Recorder

Aug 14, 2025 · attack.defense-evasion attack.t1562.008 ·

Share on:

Detects AWS Config Service disabling