Suspicious AWS S3 Bucket Versioning Disable (via cloudtrail)

This rule detects when S3 bucket versioning is disabled. Threat actors use this method during AWS ransomware incidents prior to deleting S3 objects.

SigmamediumCloudv1

sigma

suspicious-aws-s3-bucket-versioning-disable-via-cloudtrail

title: Suspicious AWS S3 Bucket Versioning Disable (via cloudtrail)
id: 86cc7839-b489-59a7-a7bd-56847c8d52f5
status: stable
description: This rule detects when S3 bucket versioning is disabled. Threat actors use this method during AWS ransomware incidents prior to deleting S3 objects.
references:
    - https://attack.mitre.org/techniques/T1490/
    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
author: Huntrule Team
date: 2026-05-27
tags:
    - attack.impact
    - attack.t1490
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: s3.amazonaws.com
        eventName: PutBucketVersioning
        requestParameters|contains: 'Suspended'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.