AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.
FreeReviewedSigma · Low · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-07-24
- Updated
- 2026-07-31
ATT&CK techniques
ExfiltrationRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags AWS CloudTrail events where an identity performs S3 data management actions that modify bucket configuration or object replication state. Attackers may use these S3 controls to weaken security settings, alter data handling, or change replication behavior to support unauthorized access or persistence. The detection relies on CloudTrail telemetry with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and replication operations.
Reporting behind it
- github.comhttps://github.com/elastic/detection-rules/pull/1145/files
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-cloudtrail-s3-bucket-configuration-and-object-restore-tampering-via-manageme-78b3756a
title: AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
id: c8d90b9a-dced-437b-a995-7e77e03abf1a
status: test
description: This rule flags AWS CloudTrail events where an identity performs S3 data management actions that modify bucket configuration or object replication state. Attackers may use these S3 controls to weaken security settings, alter data handling, or change replication behavior to support unauthorized access or persistence. The detection relies on CloudTrail telemetry with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and replication operations.
references:
- https://github.com/elastic/detection-rules/pull/1145/files
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
- attack.exfiltration
- attack.t1537
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: s3.amazonaws.com
eventName:
- PutBucketLogging
- PutBucketWebsite
- PutEncryptionConfiguration
- PutLifecycleConfiguration
- PutReplicationConfiguration
- ReplicateObject
- RestoreObject
condition: selection
falsepositives:
- A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
- id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
type: derived