AnalysisType: rule
Filename: aws_s3_delete_bucket_encryption.py
RuleID: "AWS.S3.DeleteBucketEncryption"
DisplayName: "S3 Bucket Encryption Deleted"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- S3
- Defense Evasion
- Impact:Data Destruction
Reports:
MITRE ATT&CK:
- TA0005:T1562
- TA0040:T1485
Severity: Medium
Status: Experimental
Description: Detects when S3 bucket encryption configuration is deleted, which could expose data to unauthorized access or indicate ransomware preparation activity.
Runbook: |
1. Query CloudTrail for all S3 API calls by the userIdentity:arn on the requestParameters:bucketName in the 24 hours before and after the encryption deletion to identify if this is part of a larger attack pattern
2. Check if this user has performed DeleteBucketEncryption on this bucket in the past 90 days to determine if this is normal administrative activity
3. Find other alerts with rule IDs AWS.S3.DisableBucketLogging, AWS.S3.SuspendVersioning, or AWS.S3.DisableMfaDelete for the same bucket in the past 7 days to detect coordinated security control disabling
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html
SummaryAttributes:
- sourceIpAddress
- userAgent
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: Bucket Encryption Deleted Successfully
ExpectedResult: true
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "false",
"creationDate": "2024-01-15T10:30:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "AAAAAAAAAAAAAAAAAAAAA",
"arn": "arn:aws:iam::111111111111:role/sample-role-dreamy-yonath",
"accountId": "111111111111",
"userName": "AdminRole",
},
},
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketEncryption",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "sensitive-data-bucket",
"host": "sample-bucket-pensive-jones.s3.amazonaws.com",
"encryption": "",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
"vpcEndpointId": "vpce-1a2b3c4d",
}
- Name: Bucket Encryption Deletion Failed
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "IAMUser",
"principalId": "AIDAI23HXS4EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/testuser",
"accountId": "111111111111",
"accessKeyId": "AKIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketEncryption",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"errorCode": "AccessDenied",
"errorMessage": "Access Denied",
"requestParameters":
{
"bucketName": "sensitive-data-bucket",
"host": "sample-bucket-pensive-jones.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Different S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "PutBucketEncryption",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "sensitive-data-bucket",
"host": "sample-bucket-pensive-jones.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Non-S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::123456789012:assumed-role/AdminRole/user_name",
"accountId": "123456789012",
"accessKeyId": "ASIAIOSFODNN7EXAMPLE",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "DeleteBucketEncryption",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.42",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters": {},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-123456789012",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_s3_delete_bucket_encryption.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
def rule(event):
return (
aws_cloudtrail_success(event)
and event.get("eventSource") == "s3.amazonaws.com"
and event.get("eventName") == "DeleteBucketEncryption"
)
def title(event):
return (
f"[AWS.CloudTrail] User [{event.udm('actor_user')}] "
f"deleted bucket encryption for bucket "
f"[{event.deep_get('requestParameters', 'bucketName')}] bucket"
)
def alert_context(event):
return aws_rule_context(event)