Delete IAM user¶
An adversary may attempt to delete an IAM user within an account, to alter legitimate access or block administrative activity.
|user||str||IAM user to delete||example_user|
aws iam delete-user --user-name example_user
When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.
eventName:DeleteUser AND eventSource:*.iam.amazonaws.com
--- title: Delete IAM user id: aeffd059-cd63-4ff5-ac5f-63c79237c6fa status: experimental author: Nick Jones date: 2023-07-01 description: An adversary may attempt to delete an IAM user within an account, to alter legitimate access or block administrative activity. logsource: service: cloudtrail detection: selection_source: - eventSource: "*.iam.amazonaws.com" events: - eventName: "DeleteUser" condition: selection_source AND events level: low tags: - attack.T1531