Splunk unknown stable spl

AWS Disable Bucket Versioning

The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify `PutBucketVersioning` events with the `VersioningConfiguration.Status` set to `Suspended`. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.

View Source

Detection Logic

`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended
| rename user_name as user, requestParameters.bucketName as bucket_name
| stats count min(_time) as firstTime max(_time) as lastTime
    BY signature dest user
       user_agent src vendor_account
       vendor_region vendor_product bucket_name
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `aws_disable_bucket_versioning_filter`

False Positives

  • ⚠ It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.

Field Validations

Loading…

Comments (0)

Loading comments...