AWS IAM MFA Deactivation detected

Lingesh R@bakerexpress

•updated Jun 30, 2025•5•3•63

Detects suspicious AWS API calls to DeactivateMFADevice and DeleteVirtualMFADevice, which may indicate attempts to disable MFA and evade detection.