AWS S3 Bucket Versioning Disabled via PutBucketVersioning (CloudTrail)
Alerts on CloudTrail PutBucketVersioning requests that suspend S3 bucket versioning.
- Product
- aws
- Service
- cloudtrail
- Author
- Sean Johnstone | Unit 42 (SigmaHQ), DRL 1.1
- Published
- 2023-10-28
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies CloudTrail events where an S3 bucket’s versioning is changed to a suspended state via PutBucketVersioning. Disabling versioning can reduce the ability to recover prior object states and is a common preparatory step before destructive actions such as object deletion. It relies on AWS CloudTrail telemetry for the PutBucketVersioning event and matches request parameters containing “Suspended.”
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AWS S3 Bucket Versioning Disabled via PutBucketVersioning (CloudTrail)
id: 14708602-c18c-4f15-8db4-2e018a9a2018
status: test
description: This rule identifies CloudTrail events where an S3 bucket’s versioning is changed to a suspended state via PutBucketVersioning. Disabling versioning can reduce the ability to recover prior object states and is a common preparatory step before destructive actions such as object deletion. It relies on AWS CloudTrail telemetry for the PutBucketVersioning event and matches request parameters containing “Suspended.”
references:
- https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml
author: Sean Johnstone | Unit 42, Huntrule Team
date: 2023-10-28
tags:
- attack.impact
- attack.t1490
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: s3.amazonaws.com
eventName: PutBucketVersioning
requestParameters|contains: Suspended
condition: selection
falsepositives:
- AWS administrator legitimately disabling bucket versioning
level: medium
license: DRL-1.1
related:
- id: a136ac98-b2bc-4189-a14d-f0d0388e57a7
type: derived