AWS S3 Bucket Versioning Disabled via PutBucketVersioning (CloudTrail)

Alerts on CloudTrail PutBucketVersioning requests that suspend S3 bucket versioning.

FreeUnreviewedSigmamediumv1

aws-s3-bucket-versioning-disabled-via-putbucketversioning-cloudtrail-a136ac98

title: AWS S3 Bucket Versioning Disabled via PutBucketVersioning (CloudTrail)
id: 14708602-c18c-4f15-8db4-2e018a9a2018
status: test
description: This rule identifies CloudTrail events where an S3 PutBucketVersioning request contains the parameter value indicating versioning is Suspended. Disabling versioning can reduce the ability to recover from malicious or accidental object changes and is a common precursor to broader ransomware-style impact in cloud environments. It relies on AWS CloudTrail telemetry for the S3 event source, the PutBucketVersioning action, and the presence of the Suspended request parameter.
references:
  - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml
author: Sean Johnstone | Unit 42, Huntrule Team
date: 2023-10-28
tags:
  - attack.impact
  - attack.t1490
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: s3.amazonaws.com
    eventName: PutBucketVersioning
    requestParameters|contains: Suspended
  condition: selection
falsepositives:
  - AWS administrator legitimately disabling bucket versioning
level: medium
license: DRL-1.1
related:
  - id: a136ac98-b2bc-4189-a14d-f0d0388e57a7
    type: derived

What it detects

This rule identifies CloudTrail events where an S3 PutBucketVersioning request contains the parameter value indicating versioning is Suspended. Disabling versioning can reduce the ability to recover from malicious or accidental object changes and is a common precursor to broader ransomware-style impact in cloud environments. It relies on AWS CloudTrail telemetry for the S3 event source, the PutBucketVersioning action, and the presence of the Suspended request parameter.

Known false positives

AWS administrator legitimately disabling bucket versioning

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.