AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
Flags successful CloudTrail DeleteBucket events indicating an S3 bucket was removed.
FreeReviewedSigma · Medium · v5
- Product
- aws
- Service
- cloudtrail
- Author
- Ivan Saakov, Nasreddine Bencherchali (SigmaHQ), DRL 1.1
- Published
- 2025-10-19
- Updated
- 2026-07-31
What it detects
This rule identifies S3 bucket deletion activity by matching CloudTrail events where the event name is DeleteBucket and the operation completed successfully. Bucket deletion is a high-impact action that can indicate attempted data loss or unauthorized resource removal. It relies on CloudTrail telemetry fields for eventName and errorCode, including handling for both explicit Success and null errorCode values.
Reporting behind it
- docs.aws.amazon.comhttps://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
- awscli.amazonaws.comhttps://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
aws-s3-bucket-deletion-observed-in-cloudtrail-39c9f26d
title: AWS CloudTrail S3 DeleteBucket Events with Successful Deletion
id: e8b9c6d0-f83f-43ca-b39d-1647dc324a56
status: experimental
description: This rule identifies S3 bucket deletion activity by matching CloudTrail events where the event name is DeleteBucket and the operation completed successfully. Bucket deletion is a high-impact action that can indicate attempted data loss or unauthorized resource removal. It relies on CloudTrail telemetry fields for eventName and errorCode, including handling for both explicit Success and null errorCode values.
references:
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml
author: Ivan Saakov, Nasreddine Bencherchali, Huntrule Team
date: 2025-10-19
tags:
- attack.stealth
logsource:
product: aws
service: cloudtrail
detection:
selection_event_name:
eventName: DeleteBucket
selection_status_success:
errorCode: Success
selection_status_null:
errorCode: null
condition: selection_event_name and 1 of selection_status_*
falsepositives:
- During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.
level: medium
license: DRL-1.1
related:
- id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112
type: derived