AWS S3 Bucket MFA Delete Disabled

  1[metadata]
  2creation_date = "2026/08/14"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/08/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when MFA Delete is disabled on an Amazon S3 bucket. MFA Delete is an additional layer of
 11security for versioned S3 buckets that requires multi-factor authentication to permanently delete
 12object versions or disable versioning. When MFA Delete is disabled, an adversary with S3 write
 13access and a compromised long-term access key can permanently delete object versions, a critical
 14step in ransomware attacks that target S3 versioning as a backup mechanism. MFA Delete is
 15configured via PutBucketVersioning with the MfaDelete parameter set to Disabled.
 16"""
 17false_positives = [
 18    """
 19    Disabling MFA Delete when rotating the root account credentials used to manage versioning
 20    may trigger this rule. This operation requires root account credentials and is uncommon
 21    in automated pipelines.
 22    """,
 23]
 24from = "now-6m"
 25index = ["logs-aws.cloudtrail-*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "AWS S3 Bucket MFA Delete Disabled"
 29note = """## Triage and analysis
 30
 31### Investigating AWS S3 Bucket MFA Delete Disabled
 32
 33MFA Delete protects versioned S3 buckets by requiring MFA authentication to permanently delete object versions or change the versioning state. This protection is specifically designed to prevent ransomware from destroying version history after encrypting the current object copies. Disabling MFA Delete removes this safeguard and is a recognized ransomware preparation step.
 34
 35Importantly, only the AWS account root user can enable or disable MFA Delete. A `PutBucketVersioning` call disabling MFA Delete from a non-root identity is a strong indicator of root credential compromise or unauthorized use.
 36
 37### Possible investigation steps
 38
 39- Identify the caller from `aws.cloudtrail.user_identity.type`. If this is not a `Root` identity, treat it as high-confidence unauthorized access.
 40- Check `aws.cloudtrail.request_parameters` to confirm `VersioningConfiguration={... MfaDelete=Disabled}` is present.
 41- Review all API calls by the same identity in the surrounding window for other data-destruction or encryption-related actions.
 42- Check whether object versioning remains enabled on the affected bucket. If both versioning and MFA Delete are disabled, the bucket has no object-level recovery protection.
 43- Investigate whether MFA was presented (`aws.cloudtrail.additional_eventdata` contains MFA information for requests that required it).
 44
 45### Response and remediation
 46
 47- If unauthorized, immediately re-enable MFA Delete using root credentials and verify that object version history is intact.
 48- Rotate all credentials associated with the calling identity.
 49- Review S3 object versions for any permanent deletions that occurred after MFA Delete was disabled.
 50- Enable AWS Config rules to detect versioning and MFA Delete configuration changes.
 51"""
 52references = [
 53    "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html",
 54    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html",
 55    "https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/",
 56    "https://www.halcyon.ai/blog/abusing-aws-native-services-ransomware-encrypting-s3-buckets-with-sse-c",
 57]
 58risk_score = 73
 59rule_id = "b8654454-2757-41b4-ae1a-69b3be704c28"
 60setup = "The AWS integration must be ingesting management events into `logs-aws.cloudtrail-*`. S3 management events are logged by default."
 61severity = "high"
 62tags = [
 63    "Domain: Cloud",
 64    "Platform: AWS",
 65    "Data Source: AWS CloudTrail",
 66    "Service: AWS S3",
 67    "Rule Type: Custom Query (KQL)",
 68    "Tactic: Impact",
 69    "Resources: Investigation Guide",
 70]
 71timestamp_override = "event.ingested"
 72type = "query"
 73
 74query = '''
 75data_stream.dataset: "aws.cloudtrail"
 76    and event.provider: "s3.amazonaws.com"
 77    and event.action: "PutBucketVersioning"
 78    and event.outcome: "success"
 79    and aws.cloudtrail.flattened.request_parameters.VersioningConfiguration.MfaDelete: "Disabled"
 80'''
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84[[rule.threat.technique]]
 85id = "T1490"
 86name = "Inhibit System Recovery"
 87reference = "https://attack.mitre.org/techniques/T1490/"
 88
 89[rule.threat.tactic]
 90id = "TA0040"
 91name = "Impact"
 92reference = "https://attack.mitre.org/tactics/TA0040/"
 93
 94[rule.investigation_fields]
 95field_names = [
 96    "@timestamp",
 97    "aws.cloudtrail.user_identity.arn",
 98    "aws.cloudtrail.user_identity.type",
 99    "user.name",
100    "event.action",
101    "event.outcome",
102    "service.target.entity.id",
103    "aws.cloudtrail.request_parameters",
104    "source.ip",
105    "cloud.region",
106    "cloud.account.id",
107]