Splunk unknown stable spl

ASL AWS Disable Bucket Versioning

The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.

View Source

Detection Logic

`amazon_security_lake` api.operation=PutBucketVersioning
| spath input=api.request.data path=VersioningConfiguration.Status output=Status
| spath input=api.request.data path=bucketName output=bucketName
| search Status=Suspended
| fillnull
| stats count min(_time) as firstTime max(_time) as lastTime
    BY actor.user.uid api.operation api.service.name
       http_request.user_agent src_endpoint.ip actor.user.account.uid
       cloud.provider cloud.region api.request.data
       bucketName
| rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `asl_aws_disable_bucket_versioning_filter`

False Positives

⚠ It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.

Field Validations

Loading…

Comments (0)

Loading comments...