AWS S3 Bucket Versioning Disable

Title: AWS S3 Bucket Versioning Disable
Status: test
Description:Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.
References:
  -https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82
Author: Sean Johnstone | Unit 42
Date: 2023-10-28
modified:None
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 's3.amazonaws.com'
    eventName: 'PutBucketVersioning'
    requestParameters|contains: 'Suspended'
  condition:selection
Falsepositives:
  -AWS administrator legitimately disabling bucket versioning
Level: medium