AWS S3 Bucket Versioning Disable

Status: test
Severity: medium
Log source: product aws, service cloudtrail
Author: Sean Johnstone | Unit 42
Source: github.com/SigmaHQ/sigma

Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.

Known false positives

AWS administrator legitimately disabling bucket versioning

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1490` Inhibit System Recovery

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `PutBucketVersioning`: Sets the versioning state for a specified S3 bucket.

Rules detecting the same action

These rules filter on the same operation.

AWS S3 Object Versioning Suspended (Elastic)
AWS S3 Security Control Disabling (Panther)
S3 Bucket Versioning Suspended (Panther)
S3 MFA Delete Disabled (Panther)

Rule body

title: AWS S3 Bucket Versioning Disable
id: a136ac98-b2bc-4189-a14d-f0d0388e57a7
status: test
description: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
references:
    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
author: Sean Johnstone | Unit 42
date: 2023-10-28
tags:
    - attack.impact
    - attack.t1490
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: s3.amazonaws.com
        eventName: PutBucketVersioning
        requestParameters|contains: 'Suspended'
    condition: selection
falsepositives:
    - AWS administrator legitimately disabling bucket versioning
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: s3.amazonaws.com
    eventName: PutBucketVersioning
    requestParameters|contains: 'Suspended'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`PutBucketVersioning`	`field:"aws::eventName" kind:eq value:"PutBucketVersioning"`
`eventSource`	eq	`s3.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"s3.amazonaws.com"`
`requestParameters`	match	`Suspended`	`field:"aws::requestParameters" kind:match value:"Suspended"`