AWS S3 Bucket Versioning Disable

calendar Sep 2, 2024 · attack.impact attack.t1490  ·
Share on: linkedin copy

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Sigma rule (View on GitHub)

 1title: AWS S3 Bucket Versioning Disable
 2id: a136ac98-b2bc-4189-a14d-f0d0388e57a7
 3status: test
 4description: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
 5references:
 6    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
 7author: Sean Johnstone | Unit 42
 8date: 2023-10-28
 9tags:
10    - attack.impact
11    - attack.t1490
12logsource:
13    product: aws
14    service: cloudtrail
15detection:
16    selection:
17        eventSource: s3.amazonaws.com
18        eventName: PutBucketVersioning
19        requestParameters|contains: 'Suspended'
20    condition: selection
21falsepositives:
22    - AWS administrator legitimately disabling bucket versioning
23level: medium

References

Related rules

to-top