Elastic high stable kql

AWS S3 Bucket MFA Delete Disabled

Detects when MFA Delete is disabled on an Amazon S3 bucket. MFA Delete is an additional layer of security for versioned S3 buckets that requires multi-factor authentication to permanently delete object versions or disable versioning. When MFA Delete is disabled, an adversary with S3 write access and a compromised long-term access key can permanently delete object versions, a critical step in ransomware attacks that target S3 versioning as a backup mechanism. MFA Delete is configured via PutBucketVersioning with the MfaDelete parameter set to Disabled.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketVersioning"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.VersioningConfiguration.MfaDelete: "Disabled"

False Positives

  • ⚠ Disabling MFA Delete when rotating the root account credentials used to manage versioning may trigger this rule. This operation requires root account credentials and is uncommon in automated pipelines.

Field Validations

Loading…

Comments (0)

Loading comments...