AnalysisType: rule
Filename: aws_s3_delete_bucket_replication.py
RuleID: "AWS.S3.DeleteBucketReplication"
DisplayName: "S3 Bucket Replication Deleted"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Defense Evasion
- Impact:Data Destruction
Reports:
MITRE ATT&CK:
- TA0005:T1562
- TA0040:T1485
Severity: Medium
Description: Detects when S3 bucket replication configuration is deleted, which could prevent data backup and indicate ransomware preparation activity.
Runbook: |
1. Query CloudTrail for all S3 API calls by the userIdentity:arn on the requestParameters:bucketName in the 24 hours before and after the replication deletion to establish full activity context
2. Check if this user has historically managed replication settings for this bucket in the past 90 days to verify if this is authorized administrative work
3. Find other alerts indicating security control disabling (DeleteBucketEncryption, SuspendVersioning, DisableBucketLogging) for the same bucket in the past 7 days to identify ransomware preparation patterns
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html
SummaryAttributes:
- sourceIpAddress
- userAgent
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: Bucket Replication Deleted Successfully
ExpectedResult: true
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "false",
"creationDate": "2024-01-15T10:30:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "AAAAAAAAAAAAAAAAAAAAA",
"arn": "arn:aws:iam::111111111111:role/sample-role-dreamy-yonath",
"accountId": "111111111111",
"userName": "AdminRole",
},
},
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketReplication",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "production-backup-bucket",
"host": "sample-bucket-serene-pike.s3.amazonaws.com",
"replication": "",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
"vpcEndpointId": "vpce-1a2b3c4d",
}
- Name: Bucket Replication Deletion Failed
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "IAMUser",
"principalId": "AIDAI23HXS4EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/testuser",
"accountId": "111111111111",
"accessKeyId": "AKIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "DeleteBucketReplication",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"errorCode": "AccessDenied",
"errorMessage": "Access Denied",
"requestParameters":
{
"bucketName": "production-backup-bucket",
"host": "sample-bucket-serene-pike.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Different S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
"accountId": "111111111111",
"accessKeyId": "ASIA-MOCKACCESSKEYID-1",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "s3.amazonaws.com",
"eventName": "PutBucketReplication",
"awsRegion": "us-east-1",
"sourceIPAddress": "1.2.3.4",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters":
{
"bucketName": "production-backup-bucket",
"host": "sample-bucket-serene-pike.s3.amazonaws.com",
},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-111111111111",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
}
- Name: Non-S3 Event
ExpectedResult: false
Log:
{
"eventVersion": "1.08",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
"arn": "arn:aws:sts::123456789012:assumed-role/AdminRole/user_name",
"accountId": "123456789012",
"accessKeyId": "ASIAIOSFODNN7EXAMPLE",
},
"eventTime": "2024-01-15T10:45:23Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "DeleteBucketReplication",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.42",
"userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
"requestParameters": {},
"responseElements": null,
"requestID": "ABC123DEF456",
"eventID": "12345678-1234-1234-1234-123456789012",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_s3_delete_bucket_replication.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
def rule(event):
return (
aws_cloudtrail_success(event)
and event.get("eventSource") == "s3.amazonaws.com"
and event.get("eventName") == "DeleteBucketReplication"
)
def title(event):
return (
f"[AWS.CloudTrail] User [{event.udm('actor_user')}] "
f"deleted bucket replication for bucket "
f"[{event.deep_get('requestParameters', 'bucketName')}] bucket"
)
def alert_context(event):
return aws_rule_context(event)