AWS S3 Bucket Configuration Deletion

  1[metadata]
  2creation_date = "2020/05/27"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies the deletion of critical Amazon S3 bucket configurations such as bucket policies, lifecycle configurations
 11or encryption settings. These actions are typically administrative but may also represent
 12adversarial attempts to remove security controls, disable data retention mechanisms, or conceal evidence of malicious
 13activity. Adversaries who gain access to AWS credentials may delete logging, lifecycle, or policy configurations to
 14disrupt forensic visibility and inhibit recovery. For example, deleting a bucket policy can open a bucket to public
 15access or remove protective access restrictions, while deleting lifecycle rules can prevent object archival or automatic
 16backups. Such actions often precede data exfiltration or destructive operations and should be reviewed in context with
 17related S3 or IAM events.
 18"""
 19false_positives = [
 20    """
 21    Bucket configurations may be deleted by a system or network administrator. Verify whether the user identity, user agent,
 22    and/or hostname should be making changes in your environment. Bucket configuration deletions by unfamiliar users or
 23    hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
 24    """,
 25]
 26from = "now-6m"
 27index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 28language = "kuery"
 29license = "Elastic License v2"
 30name = "AWS S3 Bucket Configuration Deletion"
 31note = """## Triage and analysis
 32
 33### Investigating AWS S3 Bucket Configuration Deletion
 34
 35Amazon S3 is a scalable storage service where configurations like policies, replication, and encryption ensure data security and compliance. The detection rule monitors successful deletions of these configurations via the following APIs: `DeleteBucketPolicy`, `DeleteBucketReplication`, `DeleteBucketCors`, `DeleteBucketEncryption` or `DeleteBucketLifecycle`. These operations can be used by an adversary to remove visibility, erase governance or compliance controls, or prepare a bucket for destructive or exfiltration activity.  
 36Deleting or disabling important configurations may hamper audit trails, hide malicious changes, or reduce the ability for recovery. The detection of these deletes is therefore a potential indicator of defense evasion or impact techniques.
 37
 38#### Possible investigation steps
 39
 40- **Identify the Actor and Context**  
 41  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.access_key_id` and `aws.cloudtrail.user_identity.type` to identify who performed the deletion.  
 42  - Determine whether the actor typically manages bucket configurations, or if this is an unusual identity for this kind of operation.  
 43  - Check `source.ip`, `user_agent.original`, `cloud.region` for anomalous behaviour (unfamiliar IPs, new tooling or region, off-hours actions).
 44
 45- **Determine the Affected Bucket and Configuration Type**  
 46  - Examine `aws.cloudtrail.request_parameters` (and `aws.cloudtrail.resources.arn`) to identify the bucket and the sub-resource that was removed. 
 47  - Determine whether the bucket is used for critical data (audit logs, backups, data warehouse). If so, the deletion is higher risk.
 48
 49- **Correlate with Other Activity to Establish Chain of Events**  
 50  - Search for preceding or concurrent CloudTrail events by the same actor or on the same bucket, e.g.:  
 51    - Removal of logging or access controls (`PutBucketLogging`, `PutBucketAcl`, `PutBucketPolicy`).  
 52    - Object-level actions soon after configuration removal (`DeleteObject`, `DeleteObjects`, `PutObject`, cross-account copy) that suggest data removal or exfiltration.  
 53  - Review for configuration additions or changes immediately prior (e.g., versioning disabled, replication removed) — could form part of a larger attack sequence.  
 54
 55- **Evaluate Intent and Risk**  
 56  - Confirm whether the change is aligned with an approved change control process (maintenance, re-architecting, cost-optimization).  
 57  - If no documented justification, or if it affects buckets with sensitive or compliance-related data, treat it as potential malicious behavior.  
 58  - Prioritize buckets where configuration deletion significantly reduces visibility or recovery capability.
 59
 60### False positive analysis
 61
 62- **Scheduled Maintenance or Re-architecture**:  
 63  - Valid operations may include migrating buckets, retiring services, or reorganizing storage; verify through change logs.  
 64- **Automation/DevOps Activity**:  
 65  - Infrastructure-as-Code pipelines or lifecycle clean-up tasks may remove configurations; validate known automation scopes and service-principals.  
 66- **Test/Development Buckets**:  
 67  - Non-production environments may frequently change bucket configurations; document and consider whitelisting accordingly.
 68
 69### Response and remediation
 70
 71**Containment & Immediate Actions**  
 72- Temporarily restrict the IAM user or role that performed the deletion, especially for `DeleteBucketPolicy`, `DeleteBucketEncryption`, or `DeleteBucketLifecycle`. 
 73- Restore missing configurations as soon as possible (e.g., re-apply bucket policy, lifecycle rules, inventory configuration) to prevent further blind spots.
 74
 75**Investigation & Scope Assessment**  
 76- Using CloudTrail and S3 Data Events, check object‐level activity from the timeframe immediately before and after the configuration deletion. Look for bulk deletes, new uploads, or copies to external accounts.  
 77- Check whether other buckets in the account suffered similar configuration changes – potentially part of a wider campaign.
 78
 79**Recovery & Hardening**  
 80- Recover affected bucket configurations and ensure they match your organizational baseline and compliance standards (e.g., logging enabled, inventory configured, lifecycle rules active).  
 81- Enable AWS Config rules such as `s3-bucket-policy-check`, `s3-bucket-lifecycle-configuration-check`, `s3-bucket-logging-enabled` to monitor for unauthorized changes.  
 82- Apply least‐privilege for configuration deletion permissions; segregate duties so bucket config deletion can only be done via controlled workflows and require multi-step approval.
 83
 84**Lessons Learned & Prevention**  
 85- Conduct a post-incident review to determine root cause (credential compromise, misconfigured automation, malicious insider) and strengthen monitoring, alerting and access controls accordingly.
 86
 87"""
 88references = [
 89    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html",
 90    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html",
 91    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketCors.html",
 92    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketEncryption.html",
 93    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketLifecycle.html",
 94]
 95risk_score = 21
 96rule_id = "227dc608-e558-43d9-b521-150772250bae"
 97severity = "low"
 98tags = [
 99    "Domain: Cloud",
100    "Data Source: AWS",
101    "Data Source: Amazon Web Services",
102    "Platform: AWS",
103    "Data Source: AWS CloudTrail",
104    "Service: AWS S3",
105    "Tactic: Defense Evasion",
106    "Tactic: Impact",
107    "Rule Type: Custom Query (KQL)",
108    "Resources: Investigation Guide",
109    "Noise: Medium",
110    "Performance: Normal",
111    "Threat: Ransomware",
112]
113timestamp_override = "event.ingested"
114type = "query"
115
116query = '''
117data_stream.dataset:aws.cloudtrail and 
118    event.provider:s3.amazonaws.com and
119    event.action:(DeleteBucketPolicy or 
120                    DeleteBucketReplication or 
121                    DeleteBucketCors or 
122                    DeleteBucketEncryption or 
123                    DeleteBucketLifecycle) and 
124    event.outcome:success
125    and not user_agent.original: (*Terraform* or *Pulumi*)
126'''
127
128
129[[rule.threat]]
130framework = "MITRE ATT&CK"
131
132[[rule.threat.technique]]
133id = "T1070"
134name = "Indicator Removal"
135reference = "https://attack.mitre.org/techniques/T1070/"
136
137[[rule.threat.technique]]
138id = "T1562"
139name = "Impair Defenses"
140reference = "https://attack.mitre.org/techniques/T1562/"
141
142[[rule.threat.technique.subtechnique]]
143id = "T1562.001"
144name = "Disable or Modify Tools"
145reference = "https://attack.mitre.org/techniques/T1562/001/"
146
147[[rule.threat.technique.subtechnique]]
148id = "T1562.008"
149name = "Disable or Modify Cloud Logs"
150reference = "https://attack.mitre.org/techniques/T1562/008/"
151
152[rule.threat.tactic]
153id = "TA0005"
154name = "Defense Evasion"
155reference = "https://attack.mitre.org/tactics/TA0005/"
156
157[[rule.threat]]
158framework = "MITRE ATT&CK"
159
160[[rule.threat.technique]]
161id = "T1490"
162name = "Inhibit System Recovery"
163reference = "https://attack.mitre.org/techniques/T1490/"
164
165[rule.threat.tactic]
166id = "TA0040"
167name = "Impact"
168reference = "https://attack.mitre.org/tactics/TA0040/"
169[rule.investigation_fields]
170field_names = [
171    "@timestamp",
172    "user.name",
173    "user_agent.original",
174    "source.ip",
175    "aws.cloudtrail.user_identity.arn",
176    "aws.cloudtrail.user_identity.type",
177    "aws.cloudtrail.user_identity.access_key_id",
178    "aws.cloudtrail.resources.arn",
179    "aws.cloudtrail.resources.type",
180    "event.action",
181    "event.outcome",
182    "cloud.account.id",
183    "cloud.region",
184    "aws.cloudtrail.request_parameters",
185    "aws.cloudtrail.response_elements",
186]