huntrule

AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls

Flags CloudTrail S3 management API actions that modify bucket protections or move/restore objects.

FreeReviewedSigma · Low · v5
Product
aws
Service
cloudtrail
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-07-24
Updated
2026-07-31
AnalysisDetection
title: AWS CloudTrail S3 Bucket/Replication Configuration Tampering via Management API Calls
id: c8d90b9a-dced-437b-a995-7e77e03abf1a
status: test
description: This rule flags AWS CloudTrail events where an identity performs S3 data management actions that modify bucket configuration or object replication state. Attackers may use these S3 controls to weaken security settings, alter data handling, or change replication behavior to support unauthorized access or persistence. The detection relies on CloudTrail telemetry with eventSource set to s3.amazonaws.com and eventName matching the listed S3 management and replication operations.
references:
  - https://github.com/elastic/detection-rules/pull/1145/files
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-10-09
tags:
  - attack.exfiltration
  - attack.t1537
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: s3.amazonaws.com
    eventName:
      - PutBucketLogging
      - PutBucketWebsite
      - PutEncryptionConfiguration
      - PutLifecycleConfiguration
      - PutReplicationConfiguration
      - ReplicateObject
      - RestoreObject
  condition: selection
falsepositives:
  - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
    type: derived