Skip to content

Commit b3502f7

Browse files
authored
[Rule Tuning] AWS S3 Bucket Configuration Deletion (#5265)
No major query logic changes needed. This rule is performing as expected in telemetry, known to be a bit noisier in development environments where bucket configuration changes and deletions happen often. - updated Description and IG - reduced execution window - updated MITRE mapping - updated tags - added highlighted fields
1 parent 7b7082e commit b3502f7

File tree

1 file changed

+108
-31
lines changed

1 file changed

+108
-31
lines changed

rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml

Lines changed: 108 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -2,21 +2,29 @@
22
creation_date = "2020/05/27"
33
integration = ["aws"]
44
maturity = "production"
5-
updated_date = "2025/01/15"
5+
updated_date = "2025/10/29"
66

77
[rule]
88
author = ["Elastic"]
9-
description = "Identifies the deletion of various Amazon Simple Storage Service (S3) bucket configuration components."
9+
description = """
10+
Identifies the deletion of critical Amazon S3 bucket configurations such as bucket policies, lifecycle configurations
11+
or encryption settings. These actions are typically administrative but may also represent
12+
adversarial attempts to remove security controls, disable data retention mechanisms, or conceal evidence of malicious
13+
activity. Adversaries who gain access to AWS credentials may delete logging, lifecycle, or policy configurations to
14+
disrupt forensic visibility and inhibit recovery. For example, deleting a bucket policy can open a bucket to public
15+
access or remove protective access restrictions, while deleting lifecycle rules can prevent object archival or automatic
16+
backups. Such actions often precede data exfiltration or destructive operations and should be reviewed in context with
17+
related S3 or IAM events.
18+
"""
1019
false_positives = [
1120
"""
12-
Bucket components may be deleted by a system or network administrator. Verify whether the user identity, user agent,
13-
and/or hostname should be making changes in your environment. Bucket component deletions by unfamiliar users or
21+
Bucket configurations may be deleted by a system or network administrator. Verify whether the user identity, user agent,
22+
and/or hostname should be making changes in your environment. Bucket configuration deletions by unfamiliar users or
1423
hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
1524
""",
1625
]
17-
from = "now-60m"
26+
from = "now-6m"
1827
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
19-
interval = "10m"
2028
language = "kuery"
2129
license = "Elastic License v2"
2230
name = "AWS S3 Bucket Configuration Deletion"
@@ -27,37 +35,59 @@ note = """## Triage and analysis
2735
2836
### Investigating AWS S3 Bucket Configuration Deletion
2937
30-
Amazon S3 is a scalable storage service where configurations like policies, replication, and encryption ensure data security and compliance. Adversaries may delete these configurations to evade defenses, disrupt data protection, or conceal malicious activities. The detection rule monitors successful deletions of these configurations, signaling potential defense evasion attempts by correlating specific CloudTrail events.
38+
Amazon S3 is a scalable storage service where configurations like policies, replication, and encryption ensure data security and compliance. The detection rule monitors successful deletions of these configurations via the following APIs: `DeleteBucketPolicy`, `DeleteBucketReplication`, `DeleteBucketCors`, `DeleteBucketEncryption` or `DeleteBucketLifecycle`. These operations can be used by an adversary to remove visibility, erase governance or compliance controls, or prepare a bucket for destructive or exfiltration activity.
39+
Deleting or disabling important configurations may hamper audit trails, hide malicious changes, or reduce the ability for recovery. The detection of these deletes is therefore a potential indicator of defense evasion or impact techniques.
3140
32-
### Possible investigation steps
41+
#### Possible investigation steps
3342
34-
- Review the CloudTrail logs for the specific event.provider:s3.amazonaws.com and event.action values to identify the user or role responsible for the deletion actions.
35-
- Examine the event.outcome:success field to confirm that the deletion actions were completed successfully and not attempted or failed.
36-
- Investigate the IAM policies and permissions associated with the user or role identified to determine if they have legitimate access to perform such deletions.
37-
- Check for any recent changes in IAM roles or policies that might have inadvertently granted excessive permissions.
38-
- Correlate the timing of the deletion events with other suspicious activities or alerts in the AWS environment to identify potential patterns or coordinated actions.
39-
- Assess the impact of the deleted configurations on data security and compliance, and determine if any critical data protection mechanisms were affected.
43+
- **Identify the Actor and Context**
44+
- Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.access_key_id` and `aws.cloudtrail.user_identity.type` to identify who performed the deletion.
45+
- Determine whether the actor typically manages bucket configurations, or if this is an unusual identity for this kind of operation.
46+
- Check `source.ip`, `user_agent.original`, `cloud.region` for anomalous behaviour (unfamiliar IPs, new tooling or region, off-hours actions).
47+
48+
- **Determine the Affected Bucket and Configuration Type**
49+
- Examine `aws.cloudtrail.request_parameters` (and `aws.cloudtrail.resources.arn`) to identify the bucket and the sub-resource that was removed.
50+
- Determine whether the bucket is used for critical data (audit logs, backups, data warehouse). If so, the deletion is higher risk.
51+
52+
- **Correlate with Other Activity to Establish Chain of Events**
53+
- Search for preceding or concurrent CloudTrail events by the same actor or on the same bucket, e.g.:
54+
- Removal of logging or access controls (`PutBucketLogging`, `PutBucketAcl`, `PutBucketPolicy`).
55+
- Object-level actions soon after configuration removal (`DeleteObject`, `DeleteObjects`, `PutObject`, cross-account copy) that suggest data removal or exfiltration.
56+
- Review for configuration additions or changes immediately prior (e.g., versioning disabled, replication removed) — could form part of a larger attack sequence.
57+
58+
- **Evaluate Intent and Risk**
59+
- Confirm whether the change is aligned with an approved change control process (maintenance, re-architecting, cost-optimization).
60+
- If no documented justification, or if it affects buckets with sensitive or compliance-related data, treat it as potential malicious behavior.
61+
- Prioritize buckets where configuration deletion significantly reduces visibility or recovery capability.
4062
4163
### False positive analysis
4264
43-
- Routine administrative actions by authorized personnel may trigger alerts when they update or remove bucket configurations as part of regular maintenance. To manage this, create exceptions for specific user roles or IAM users known to perform these tasks regularly.
44-
- Automated scripts or tools used for infrastructure management might delete and recreate bucket configurations as part of their operation. Identify these scripts and exclude their associated actions from triggering alerts by using specific identifiers or tags.
45-
- Scheduled policy updates or compliance checks that involve temporary removal of configurations can also result in false positives. Implement time-based exceptions for these known activities to prevent unnecessary alerts.
46-
- Development and testing environments often undergo frequent configuration changes, which can mimic suspicious behavior. Exclude these environments from the rule by using environment-specific tags or identifiers.
65+
- **Scheduled Maintenance or Re-architecture**:
66+
- Valid operations may include migrating buckets, retiring services, or reorganizing storage; verify through change logs.
67+
- **Automation/DevOps Activity**:
68+
- Infrastructure-as-Code pipelines or lifecycle clean-up tasks may remove configurations; validate known automation scopes and service-principals.
69+
- **Test/Development Buckets**:
70+
- Non-production environments may frequently change bucket configurations; document and consider whitelisting accordingly.
4771
4872
### Response and remediation
4973
50-
- Immediately revoke any unauthorized access to the affected S3 bucket by reviewing and updating the bucket's access policies and permissions.
51-
- Restore the deleted configurations by applying the latest known good configuration settings for policies, replication, encryption, and other affected components.
52-
- Conduct a thorough audit of recent IAM activity to identify any unauthorized or suspicious actions related to the S3 bucket configurations.
53-
- Escalate the incident to the security operations team for further investigation and to determine if additional AWS resources or accounts have been compromised.
54-
- Implement additional monitoring and alerting for any future unauthorized configuration changes to S3 buckets, focusing on the specific actions identified in the detection rule.
55-
- Review and enhance IAM policies to enforce the principle of least privilege, ensuring only authorized users have the necessary permissions to modify S3 bucket configurations.
56-
- Coordinate with the incident response team to assess the impact of the configuration deletions on data security and compliance, and take necessary steps to mitigate any identified risks.
74+
**1. Containment & Immediate Actions**
75+
- Temporarily restrict the IAM user or role that performed the deletion, especially for `DeleteBucketPolicy`, `DeleteBucketEncryption`, or `DeleteBucketLifecycle`.
76+
- Restore missing configurations as soon as possible (e.g., re-apply bucket policy, lifecycle rules, inventory configuration) to prevent further blind spots.
77+
78+
**2. Investigation & Scope Assessment**
79+
- Using CloudTrail and S3 Data Events, check object‐level activity from the timeframe immediately before and after the configuration deletion. Look for bulk deletes, new uploads, or copies to external accounts.
80+
- Check whether other buckets in the account suffered similar configuration changes – potentially part of a wider campaign.
5781
58-
## Setup
82+
**3. Recovery & Hardening**
83+
- Recover affected bucket configurations and ensure they match your organizational baseline and compliance standards (e.g., logging enabled, inventory configured, lifecycle rules active).
84+
- Enable AWS Config rules such as `s3-bucket-policy-check`, `s3-bucket-lifecycle-configuration-check`, `s3-bucket-logging-enabled` to monitor for unauthorized changes.
85+
- Apply least‐privilege for configuration deletion permissions; segregate duties so bucket config deletion can only be done via controlled workflows and require multi-step approval.
5986
60-
The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
87+
**4. Lessons Learned & Prevention**
88+
- Conduct a post-incident review to determine root cause (credential compromise, misconfigured automation, malicious insider) and strengthen monitoring, alerting and access controls accordingly.
89+
90+
"""
6191
references = [
6292
"https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketPolicy.html",
6393
"https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucketReplication.html",
@@ -72,18 +102,24 @@ tags = [
72102
"Domain: Cloud",
73103
"Data Source: AWS",
74104
"Data Source: Amazon Web Services",
105+
"Data Source: Amazon S3",
75106
"Use Case: Asset Visibility",
76107
"Tactic: Defense Evasion",
108+
"Tactic: Impact",
77109
"Resources: Investigation Guide",
78110
]
79111
timestamp_override = "event.ingested"
80112
type = "query"
81113

82114
query = '''
83-
event.dataset:aws.cloudtrail and event.provider:s3.amazonaws.com and
84-
event.action:(DeleteBucketPolicy or DeleteBucketReplication or DeleteBucketCors or
85-
DeleteBucketEncryption or DeleteBucketLifecycle)
86-
and event.outcome:success
115+
event.dataset:aws.cloudtrail and
116+
event.provider:s3.amazonaws.com and
117+
event.action:(DeleteBucketPolicy or
118+
DeleteBucketReplication or
119+
DeleteBucketCors or
120+
DeleteBucketEncryption or
121+
DeleteBucketLifecycle) and
122+
event.outcome:success
87123
'''
88124

89125

@@ -94,9 +130,50 @@ id = "T1070"
94130
name = "Indicator Removal"
95131
reference = "https://attack.mitre.org/techniques/T1070/"
96132

133+
[[rule.threat.technique]]
134+
id = "T1562"
135+
name = "Impair Defenses"
136+
reference = "https://attack.mitre.org/techniques/T1562/"
137+
[[rule.threat.technique.subtechnique]]
138+
id = "T1562.008"
139+
name = "Disable or Modify Cloud Logs"
140+
reference = "https://attack.mitre.org/techniques/T1562/008/"
141+
142+
97143

98144
[rule.threat.tactic]
99145
id = "TA0005"
100146
name = "Defense Evasion"
101147
reference = "https://attack.mitre.org/tactics/TA0005/"
148+
[[rule.threat]]
149+
framework = "MITRE ATT&CK"
150+
[[rule.threat.technique]]
151+
id = "T1490"
152+
name = "Inhibit System Recovery"
153+
reference = "https://attack.mitre.org/techniques/T1490/"
154+
155+
156+
[rule.threat.tactic]
157+
id = "TA0040"
158+
name = "Impact"
159+
reference = "https://attack.mitre.org/tactics/TA0040/"
160+
161+
[rule.investigation_fields]
162+
field_names = [
163+
"@timestamp",
164+
"user.name",
165+
"user_agent.original",
166+
"source.ip",
167+
"aws.cloudtrail.user_identity.arn",
168+
"aws.cloudtrail.user_identity.type",
169+
"aws.cloudtrail.user_identity.access_key_id",
170+
"aws.cloudtrail.resources.arn",
171+
"aws.cloudtrail.resources.type",
172+
"event.action",
173+
"event.outcome",
174+
"cloud.account.id",
175+
"cloud.region",
176+
"aws.cloudtrail.request_parameters",
177+
"aws.cloudtrail.response_elements",
178+
]
102179

0 commit comments

Comments
 (0)