Delete IAM Role¶
An adversary may attempt to delete an IAM role within an account, to alter legitimate access or block administrative activity.
|role||str||IAM role to delete||example_role|
aws iam delete-role --role-name example_role
When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.
eventName:DeleteRole AND eventSource:*.iam.amazonaws.com
--- title: Delete IAM Role id: 999d40d4-9f65-4b5c-ad2d-349a07a4b6c3 status: experimental author: Nick Jones date: 2023-07-01 description: An adversary may attempt to delete an IAM role within an account, to alter legitimate access or block administrative activity. logsource: service: cloudtrail detection: selection_source: - eventSource: "*.iam.amazonaws.com" events: - eventName: "DeleteRole" condition: selection_source AND events level: low tags: - attack.T1531