Suspicious Removal of AWS Bucket (via cloudtrail)

title: Suspicious Removal of AWS Bucket (via cloudtrail)
id: b33b9e87-729d-5d47-9599-078f226e4c20
status: stable
description: This rule detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.
references:
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
    - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
author: Huntrule Team
date: 2026-01-02
tags:
    - attack.stealth
    - attack.impact
    - attack.t1485
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event_name:
        eventName: 'DeleteBucket'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode:
    condition: selection_event_name and 1 of selection_status_*
falsepositives:
    - Unknown
level: medium