Detection rules › Sigma

AWS Bucket Deleted

Status
experimental
Severity
medium
Log source
product aws, service cloudtrail
Author
Ivan Saakov, Nasreddine Bencherchali
Source
github.com/SigmaHQ/sigma

Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

title: AWS Bucket Deleted
id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112
status: experimental
description: |
    Detects the deletion of S3 buckets in AWS CloudTrail logs.
    Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.
references:
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
author: Ivan Saakov, Nasreddine Bencherchali
date: 2025-10-19
tags:
    - attack.stealth
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event_name:
        eventName: 'DeleteBucket'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event_name and 1 of selection_status_*
falsepositives:
    - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.
level: medium

Stages and Predicates

Stage 0: condition

selection_event_name and 1 of selection_status_*

Stage 1: selection_event_name

selection_event_name:
    eventName: 'DeleteBucket'

Stage 2: selection_status_success

selection_status_success:
    errorCode: 'Success'

Stage 3: selection_status_null

selection_status_null:
    errorCode: null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
errorCodeeq
  • Success
errorCodeis_null
  • (no value, null check)
eventNameeq
  • DeleteBucket