1 rule found for "Sean Johnstone | Unit 42"
Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.