AWS S3 Bucket Deletion Observed in CloudTrail

Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.

FreeUnreviewedSigmamediumv1

aws-s3-bucket-deletion-observed-in-cloudtrail-39c9f26d

title: AWS S3 Bucket Deletion Observed in CloudTrail
id: e8b9c6d0-f83f-43ca-b39d-1647dc324a56
status: experimental
description: This rule flags successful S3 bucket deletions by looking for CloudTrail events with eventName set to DeleteBucket and an errorCode of Success (excluding events where errorCode is null). Bucket deletion can indicate destructive actions, including potential attempts to remove data or disrupt availability. The detection relies on AWS CloudTrail event telemetry, specifically the eventName and errorCode fields for S3 delete operations.
references:
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
  - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml
author: Ivan Saakov, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-19
tags:
  - attack.stealth
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event_name:
    eventName: DeleteBucket
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event_name and 1 of selection_status_*
falsepositives:
  - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.
level: medium
license: DRL-1.1
related:
  - id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112
    type: derived

What it detects

This rule flags successful S3 bucket deletions by looking for CloudTrail events with eventName set to DeleteBucket and an errorCode of Success (excluding events where errorCode is null). Bucket deletion can indicate destructive actions, including potential attempts to remove data or disrupt availability. The detection relies on AWS CloudTrail event telemetry, specifically the eventName and errorCode fields for S3 delete operations.

Known false positives

During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.