Detectionmediumexperimental
AWS Bucket Deleted
Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Ivan Saakov, Nasreddine Bencherchali (Nextron Systems)Created Sun Oct 1939c9f26d-6e3b-4dbb-9c7a-4154b0281112cloud
Log Source
AWScloudtrail
ProductAWS← raw: aws
Servicecloudtrail← raw: cloudtrail
Detection Logic
Detection Logic3 selectors
detection:
selection_event_name:
eventName: 'DeleteBucket'
selection_status_success:
errorCode: 'Success'
selection_status_null:
errorCode: null
condition: selection_event_name and 1 of selection_status_*False Positives
During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities.
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
39c9f26d-6e3b-4dbb-9c7a-4154b0281112
Status
experimental
Level
medium
Type
Detection
Created
Sun Oct 19
Path
rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml
Raw Tags
attack.defense-evasion