detection.wiki

Detection rules › Panther

AWS S3 Delete Objects Detection

Severity
informational
Compliance
Stratus Red Team aws.impact.s3-ransomware-batch-deletion
Log types
AWS.CloudTrail
Tags
AWS, S3, CloudTrail
Reference
https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-cloudtrail.html
Source
github.com/panther-labs/panther-analysis

This rule detects when multiple objects are deleted from an S3 bucket. Such actions can be indicative of unauthorized data deletion or other suspicious activities.

Rule body yaml

AnalysisType: rule
DedupPeriodMinutes: 60
DisplayName: AWS S3 Delete Objects Detection
Enabled: true
Filename: aws_s3_delete_objects.py
RuleID: "AWS.S3.DeleteObjects"
Threshold: 1
Severity: Info
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - S3
  - CloudTrail
Reports:
  Stratus Red Team:
    - aws.impact.s3-ransomware-batch-deletion
Description: >
  This rule detects when multiple objects are deleted from an S3 bucket. Such actions can be indicative of unauthorized data deletion or other suspicious activities.
Runbook: |
  Investigate the user and the actions performed on the S3 bucket to ensure they were authorized. Unauthorized deletions can lead to data loss.
  Steps to investigate:
  1. Identify the user who performed the action.
  2. Verify if the action was authorized.
  3. Check for any other suspicious activities performed by the same user.
  4. If unauthorized, take necessary actions to secure the S3 bucket and prevent further unauthorized access.
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/logging-with-cloudtrail.html
Tests:
  - Name: DeleteObjects
    LogType: AWS.CloudTrail
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.08",
        "userIdentity": {
          "type": "IAMUser",
          "principalId": "EXAMPLE",
          "arn": "arn:aws:iam::123456789012:user/Alice",
          "accountId": "123456789012",
          "accessKeyId": "EXAMPLEKEY",
          "userName": "Alice"
        },
        "eventTime": "2023-10-01T12:34:56Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "DeleteObjects",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "192.0.2.0",
        "userAgent": "aws-sdk-go/1.15.12 (go1.12.6; linux; amd64)",
        "requestParameters": {
          "bucketName": "example-bucket",
          "key": "example-object"
        },
        "responseElements": null,
        "additionalEventData": {
          "SignatureVersion": "SigV4",
          "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "bytesTransferredIn": 0,
          "bytesTransferredOut": 0
        },
        "requestID": "EXAMPLE123456789",
        "eventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
        "readOnly": false,
        "resources": [
          {
            "type": "AWS::S3::Object",
            "ARN": "arn:aws:s3:::example-bucket/example-object"
          }
        ],
        "eventType": "AwsApiCall",
        "managementEvent": false,
        "recipientAccountId": "123456789012",
        "sharedEventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
        "vpcEndpointId": "vpce-1a2b3c4d"
      }
  - Name: Other Event
    LogType: AWS.CloudTrail
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.08",
        "userIdentity": {
          "type": "IAMUser",
          "principalId": "EXAMPLE",
          "arn": "arn:aws:iam::123456789012:user/Bob",
          "accountId": "123456789012",
          "accessKeyId": "EXAMPLEKEY",
          "userName": "Bob"
        },
        "eventTime": "2023-10-01T12:34:56Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "ListBucket",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "192.0.2.0",
        "userAgent": "aws-sdk-go/1.15.12 (go1.12.6; linux; amd64)",
        "requestParameters": {
          "bucketName": "example-bucket"
        },
        "responseElements": null,
        "additionalEventData": {
          "SignatureVersion": "SigV4",
          "CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
          "bytesTransferredIn": 0,
          "bytesTransferredOut": 0
        },
        "requestID": "EXAMPLE123456789",
        "eventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
        "readOnly": true,
        "resources": [
          {
            "type": "AWS::S3::Bucket",
            "ARN": "arn:aws:s3:::example-bucket"
          }
        ],
        "eventType": "AwsApiCall",
        "managementEvent": false,
        "recipientAccountId": "123456789012",
        "sharedEventID": "EXAMPLE-1234-5678-9012-EXAMPLE",
        "vpcEndpointId": "vpce-1a2b3c4d"
      }

Detection logic

Condition

not (errorCode is_not_null or errorMessage is_not_null)
eventSource eq "s3.amazonaws.com"
eventName in ["DeleteObjects", "DeleteObjectVersion"]

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
errorCodeis_not_null(no value, null check)
errorMessageis_not_null(no value, null check)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
eventNamein
  • DeleteObjectVersion
  • DeleteObjects
eventSourceeq
  • s3.amazonaws.com

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity
actor_user
bucketNamerequestParameters.bucketName