Elastic medium stable eql

AWS S3 Object Versioning Suspended

Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted.

View Source

Detection Logic

info where data_stream.dataset == "aws.cloudtrail"
   and event.provider == "s3.amazonaws.com"
   and event.action == "PutBucketVersioning"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "Status=Suspended")
   and not user_agent.original like~ ("*Terraform*", "*Pulumi*")

False Positives

⚠ Administrators within an AWS Organization structure may legitimately suspend object versioning. Ensure that this behavior is not part of a legitimate operation before taking action.

Field Validations

Loading…

Comments (0)

Loading comments...