You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* [Rule Tuning] AWS S3 Object Versioning Suspended
AWS S3 Object Versioning Suspended
This rule is performing well in telemetry, no major query changes in terms of detection logic or rule type.
- to improve performance, changed event category field to `event.type` since `event.category` is not mapped for `PutBucketVersioning` event.action. This avoids use of `any` in query.
- added `event.provider == "s3.amazonaws.com"` to query
- added highlighted fields
- updated investigation guide
* removed some copy errors
Copy file name to clipboardExpand all lines: rules/integrations/aws/impact_s3_object_versioning_disabled.toml
+78-24Lines changed: 78 additions & 24 deletions
Original file line number
Diff line number
Diff line change
@@ -2,13 +2,14 @@
2
2
creation_date = "2024/07/12"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/02/03"
5
+
updated_date = "2025/10/28"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
10
Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted.
11
11
"""
12
+
event_category_override = "event.type"
12
13
false_positives = [
13
14
"""
14
15
Administrators within an AWS Organization structure may legitimately suspend object versioning. Ensure that this behavior is not part of a legitimate operation before taking action.
@@ -19,40 +20,75 @@ index = ["filebeat-*", "logs-aws.cloudtrail-*"]
19
20
language = "eql"
20
21
license = "Elastic License v2"
21
22
name = "AWS S3 Object Versioning Suspended"
22
-
note = """
23
+
note = """## Triage and analysis
23
24
24
-
## Triage and analysis
25
+
> **Disclaimer**:
26
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
This rule detects when object versioning for an S3 bucket is suspended. Adversaries with access to a misconfigured S3 bucket may disable object versioning prior to replacing or deleting S3 objects, inhibiting recovery initiatives.
29
-
This rule uses [EQL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-eql-rule) to look for use of the `PutBucketVersioning` operation where the `request_parameters` include `Status=Suspended`.
30
+
This rule detects when object versioning for an S3 bucket is suspended. S3 object versioning protects against data loss by maintaining prior versions of objects, allowing recovery if they are deleted or overwritten.
31
+
Adversaries with access to a misconfigured or compromised S3 bucket may disable versioning to inhibit recovery efforts, conceal data destruction, or prepare for ransomware-like activity.
32
+
This rule uses [EQL](https://www.elastic.co/guide/en/security/current/rules-ui-create.html#create-eql-rule) to detect use of the `PutBucketVersioning` API operation where the request parameters include `Status=Suspended`.
30
33
31
-
#### Possible Investigation Steps:
34
+
#### Possible investigation steps
32
35
33
-
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who performed the action. Verify if this actor typically performs such actions and if they have the necessary permissions.
34
-
- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
35
-
- **Correlate with Other Activities**: Search for related CloudTrail events before and after this action to see if the same actor or IP address engaged in other potentially suspicious activities.
36
-
- **Check for Object Deletion or Access**: Look for `DeleteObject`, `DeleteObjects`, or `GetObject` API calls to the same S3 bucket that may indicate the adversary accessing and destroying objects including older object versions.
37
-
- **Interview Relevant Personnel**: If the copy event was initiated by a user, verify the intent and authorization for this action with the person or team responsible for managing S3 buckets.
36
+
- **Identify the Actor**
37
+
- Review `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` to determine who performed the action.
38
+
- Verify whether this user or role has a legitimate operational reason to modify bucket versioning and whether such actions are common for this identity.
38
39
39
-
### False Positive Analysis:
40
+
- **Analyze the Source and Context**
41
+
- Review `source.ip` and `user_agent.original` to assess the origin of the request.
42
+
- Check for unusual geographic locations, IP ranges, or clients that do not typically manage storage configurations.
40
43
41
-
- **Legitimate Administrative Actions**: Confirm if the action aligns with legitimate administrative tasks documented in change management systems.
42
-
- **Consistency Check**: Compare the action against historical data of similar activities performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
44
+
- **Evaluate the Affected Resource**
45
+
- Review `aws.cloudtrail.resources.arn` or `aws.cloudtrail.request_parameters` to identify which bucket’s versioning was modified.
46
+
- Determine whether this bucket contains critical or regulated data (logs, backups, audit evidence, etc.) that would be impacted by versioning suspension.
43
47
44
-
### Response and Remediation:
48
+
- **Correlate with Related Activity**
49
+
- Search for additional CloudTrail events performed by the same actor or IP address within the same timeframe, such as:
50
+
- `DeleteObject`, `DeleteObjects`, or `PutBucketLifecycle` events (potential data destruction).
51
+
- `PutBucketPolicy` or `PutBucketAcl` changes (permission manipulation).
52
+
- Review other detections related to S3 buckets or IAM changes to determine if this event is part of a larger sequence of destructive or unauthorized actions.
45
53
46
-
- **Immediate Review**: If the activity was unauthorized, search for replaced or deleted objects and review the bucket's access logs for any suspicious activity.
47
-
- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning S3 bucket management and the risks of ransomware.
48
-
- **Audit S3 Bucket Policies and Permissions**: Conduct a comprehensive audit of all S3 bucket policies and associated permissions to ensure they adhere to the principle of least privilege.
49
-
- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
54
+
- **Validate Intent**
55
+
- Confirm whether this configuration change aligns with approved maintenance or automation activity (e.g., cost optimization, test environment reset).
56
+
- If no corresponding change request or justification exists, treat this as a potential defense evasion or impact event.
50
57
51
-
### Additional Information:
58
+
### False positive analysis
52
59
53
-
For further guidance on managing S3 bucket security and protecting against ransomware, refer to the [AWS S3 documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html) and AWS best practices for security. Additionally, consult the following resources for specific details on S3 ransomware protection:
54
-
- [ERMETIC REPORT - AWS S3 Ransomware Exposure in the Wild](https://s3.amazonaws.com/bizzabo.file.upload/PtZzA0eFQwV2RA5ysNeo_ERMETIC%20REPORT%20-%20AWS%20S3%20Ransomware%20Exposure%20in%20the%20Wild.pdf)
55
-
- [S3 Ransomware Part 1: Attack Vector](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)
60
+
- **Legitimate Administrative Actions**
61
+
- Administrators or infrastructure automation tools may suspend versioning during migrations or lifecycle testing. Confirm through change management documentation.
62
+
- **Automation and Pipelines**
63
+
- Verify whether Infrastructure-as-Code tools (e.g., Terraform, CloudFormation) or backup lifecycle scripts routinely modify versioning states.
64
+
- Exclude predictable automation identities where justified, while ensuring strong audit controls remain in place.
65
+
66
+
### Response and remediation
67
+
68
+
**Containment and Validation**
69
+
- Re-enable versioning immediately for the affected bucket using the AWS Console or CLI (`aws s3api put-bucket-versioning --bucket my-bucket --versioning-configuration Status=Enabled`).
70
+
- Verify the change with `get-bucket-versioning` to confirm the bucket is restored to “Enabled.”
71
+
- Identify IAM users or roles with `s3:PutBucketVersioning` permissions and restrict access to trusted administrators only.
72
+
- Preserve relevant CloudTrail, Config, and CloudWatch logs for the timeframe of the change to ensure integrity of investigation evidence.
73
+
74
+
**Investigation and Scoping**
75
+
- Search CloudTrail for related actions by the same user or IP, including `DeleteObject`, `PutBucketLifecycle`, or `PutBucketPolicy`, to determine whether versioning suspension preceded object deletion or policy manipulation.
76
+
- Review S3 access logs or Data Events for deleted, overwritten, or newly uploaded files after versioning suspension.
77
+
- Validate if the change corresponds to an authorized change request or approved pipeline deployment.
78
+
79
+
**Recovery and Hardening**
80
+
- If object loss or overwrites occurred, attempt recovery using cross-region replication, AWS Backup, or previous snapshot copies.
81
+
- Enable S3 Object Lock and MFA Delete on critical buckets to prevent future tampering.
82
+
- Configure the AWS Config rule `s3-bucket-versioning-enabled` to continuously monitor for versioning suspension and trigger automated alerts.
83
+
- Review IAM and service control policies to ensure the principle of least privilege is enforced for all S3 management actions.
84
+
- Document findings and update incident response procedures to include versioning protection as part of ransomware and data destruction prevention strategies.
85
+
86
+
87
+
### Additional information
88
+
- AWS Documentation: [Using Versioning in S3](https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html)
89
+
- API Reference: [PutBucketVersioning](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html)
90
+
- [AWS IR Playbooks](https://github.com/aws-samples/aws-incident-response-playbooks/blob/c151b0dc091755fffd4d662a8f29e2f6794da52c/playbooks/)
0 commit comments