attack.t1685.002

AWS CloudTrail Important Change

Apr 28, 2026 · attack.defense-impairment attack.t1685.002 ·

Share on:

Detects disabling, deleting and updating of a Trail

AWS Config Disabling Channel/Recorder

Apr 28, 2026 · attack.defense-impairment attack.t1685.002 ·

Share on:

Detects AWS Config Service disabling

AWS GuardDuty Detector Deleted Or Updated

Apr 28, 2026 · attack.defense-impairment attack.t1685 attack.t1685.002 ·

Share on:

Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate.