Skip to main content

AWS account closed

ID:aws_account_closed
Data type:AWS CloudTrail
Severity:
Informational
MITRE ATT&CK:TA0040:T1531

Description​

AlphaSOC detected that an AWS account was closed using the CloseAccount action. This action permanently disables an AWS account, potentially leading to the loss of associated resources and data.

Impact​

Threat actors may exploit this action to disrupt business operations, erase evidence, or sabotage an organization's AWS infrastructure. It can lead to irreparable damage and hinder incident response efforts.

Severity​

SeverityCondition
Informational
AWS account closed

Investigation and Remediation​

Review AWS CloudTrail logs to identify who performed the CloseAccount action and verify whether it was authorized. If unauthorized, contact AWS Support, conduct a comprehensive security audit, and revoke potentially compromised credentials to mitigate further damage.