S3 Bucket Logging Disabled

Description

Detects when server access logging is disabled on an S3 bucket, removing audit trail capabilities that could indicate ransomware preparation activity or an attempt to evade detection.

Query · python

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context


def rule(event):
    return (
        aws_cloudtrail_success(event)
        and event.get("eventSource") == "s3.amazonaws.com"
        and event.get("eventName") == "PutBucketLogging"
        and event.deep_get("requestParameters", "logging") == ""
    )


def title(event):
    return (
        f"[AWS.CloudTrail] User [{event.udm('actor_user')}] "
        f"disabled bucket logging for bucket "
        f"[{event.deep_get('requestParameters', 'bucketName')}]"
    )


def alert_context(event):
    return aws_rule_context(event)

Analyst notes

  1. Query CloudTrail for all S3 API calls by the userIdentity:arn on the requestParameters:bucketName in the 24 hours before and after the bucket logging was disabled to identify if this is part of a larger attack pattern
  2. Check if this user has modified bucket logging configurations in the past 90 days to determine if this is normal administrative activity
  3. Find other alerts with rule IDs AWS.S3.SuspendVersioning, AWS.S3.DisableMfaDelete, or AWS.S3.DeleteBucketEncryption for the same bucket in the past 7 days to detect coordinated security control disabling
Raw source S3 Bucket Logging Disabled · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_s3_disable_bucket_logging.py
RuleID: "AWS.S3.DisableBucketLogging"
DisplayName: "S3 Bucket Logging Disabled"
Enabled: true
CreateAlert: false
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Defense Evasion
  - Impact:Data Destruction
Reports:
  MITRE ATT&CK:
    - TA0005:T1562
    - TA0040:T1485
Severity: Low
Description: Detects when server access logging is disabled on an S3 bucket, removing audit trail capabilities that could indicate ransomware preparation activity or an attempt to evade detection.
Runbook: |
  1. Query CloudTrail for all S3 API calls by the userIdentity:arn on the requestParameters:bucketName in the 24 hours before and after the bucket logging was disabled to identify if this is part of a larger attack pattern
  2. Check if this user has modified bucket logging configurations in the past 90 days to determine if this is normal administrative activity
  3. Find other alerts with rule IDs AWS.S3.SuspendVersioning, AWS.S3.DisableMfaDelete, or AWS.S3.DeleteBucketEncryption for the same bucket in the past 7 days to detect coordinated security control disabling
Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html
SummaryAttributes:
  - sourceIpAddress
  - userAgent
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: Bucket Logging Disabled Successfully
    ExpectedResult: true
    Log:
      {
        "eventVersion": "1.11",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
            "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
            "accountId": "111111111111",
            "accessKeyId": "ASIA-MOCKACCESSKEYID-1",
            "sessionContext":
              {
                "sessionIssuer":
                  {
                    "type": "Role",
                    "principalId": "AAAAAAAAAAAAAAAAAAAAA",
                    "arn": "arn:aws:iam::111111111111:role/sample-role-quirky-greider/sso.amazonaws.com/us-west-2/sample-role-dreamy-yonath",
                    "accountId": "111111111111",
                    "userName": "AdminRole",
                  },
                "attributes":
                  {
                    "creationDate": "2024-01-15T10:30:00Z",
                    "mfaAuthenticated": "false",
                  },
              },
          },
        "eventTime": "2024-01-15T10:45:23Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "PutBucketLogging",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "1.2.3.4",
        "userAgent": "[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36]",
        "requestParameters":
          {
            "logging": "",
            "bucketName": "critical-data-bucket",
            "BucketLoggingStatus":
              {
                "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/",
              },
            "Host": "sample-bucket-great-proskuriakova.s3.us-west-2.amazonaws.com",
          },
        "responseElements": null,
        "additionalEventData":
          {
            "SignatureVersion": "SigV4",
            "CipherSuite": "TLS_AES_128_GCM_SHA256",
            "bytesTransferredIn": 108,
            "AuthenticationMethod": "AuthHeader",
            "x-amz-id-2": "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ12345678901234567890==",
            "bytesTransferredOut": 0,
          },
        "requestID": "ABC123DEF456",
        "eventID": "12345678-1234-1234-1234-111111111111",
        "readOnly": false,
        "resources":
          [
            {
              "accountId": "111111111111",
              "type": "AWS::S3::Bucket",
              "ARN": "arn:aws:s3:::sample-bucket-great-proskuriakova",
            },
          ],
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111111111111",
        "eventCategory": "Management",
        "tlsDetails":
          {
            "tlsVersion": "TLSv1.3",
            "cipherSuite": "TLS_AES_128_GCM_SHA256",
            "clientProvidedHostHeader": "sample-bucket-great-proskuriakova.s3.us-west-2.amazonaws.com",
          },
      }
  - Name: Bucket Logging Disabled - Failed
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.11",
        "userIdentity":
          {
            "type": "IAMUser",
            "principalId": "AIDAI23HXS4EXAMPLE",
            "arn": "arn:aws:iam::111111111111:user/testuser",
            "accountId": "111111111111",
            "accessKeyId": "AKIA-MOCKACCESSKEYID-1",
          },
        "eventTime": "2024-01-15T10:45:23Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "PutBucketLogging",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "1.2.3.4",
        "userAgent": "[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36]",
        "errorCode": "AccessDenied",
        "errorMessage": "Access Denied",
        "requestParameters":
          {
            "logging": "",
            "bucketName": "critical-data-bucket",
            "BucketLoggingStatus":
              {
                "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/",
              },
            "Host": "sample-bucket-great-proskuriakova.s3.us-west-2.amazonaws.com",
          },
        "responseElements": null,
        "requestID": "ABC123DEF456",
        "eventID": "12345678-1234-1234-1234-111111111111",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111111111111",
      }
  - Name: Bucket Logging Enabled
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.11",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
            "arn": "arn:aws:sts::111111111111:assumed-role/sample-role-dreamy-yonath/sample-role-brave-yalow-role-intelligent-brahmagupta-role-beautiful-keldysh-role-happy-easley-role-bold-buck",
            "accountId": "111111111111",
            "accessKeyId": "ASIA-MOCKACCESSKEYID-1",
          },
        "eventTime": "2024-01-15T10:45:23Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "PutBucketLogging",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "1.2.3.4",
        "userAgent": "[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/1.2.3.4 Safari/537.36]",
        "requestParameters":
          {
            "logging":
              [
                {
                  "targetBucket": "logging-bucket",
                  "targetPrefix": "logs/",
                },
              ],
            "bucketName": "critical-data-bucket",
            "BucketLoggingStatus":
              {
                "xmlns": "http://s3.amazonaws.com/doc/2006-03-01/",
                "LoggingEnabled":
                  {
                    "TargetBucket": "logging-bucket",
                    "TargetPrefix": "logs/",
                  },
              },
            "Host": "sample-bucket-great-proskuriakova.s3.us-west-2.amazonaws.com",
          },
        "responseElements": null,
        "requestID": "ABC123DEF456",
        "eventID": "12345678-1234-1234-1234-111111111111",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111111111111",
      }
  - Name: Logging Field Missing
    ExpectedResult: false
    Log:
      {
        "eventVersion": "1.11",
        "userIdentity":
          {
            "type": "AssumedRole",
            "principalId": "AAAAAAAAAAAAAAAAAAAAA:user_name",
            "arn": "arn:aws:sts::111111111111:assumed-role/AdminRole/user_name",
            "accountId": "111111111111",
            "accessKeyId": "ASIA-MOCKACCESSKEYID-1",
          },
        "eventTime": "2024-01-15T10:45:23Z",
        "eventSource": "s3.amazonaws.com",
        "eventName": "PutBucketLogging",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "1.2.3.4",
        "userAgent": "aws-cli/2.13.0 Python/3.11.4 Linux/5.10.0-1234-aws exe/x86_64.ubuntu.22",
        "requestParameters":
          {
            "bucketName": "critical-data-bucket",
            "Host": "critical-data-bucket.s3.us-west-2.amazonaws.com",
          },
        "responseElements": null,
        "requestID": "ABC123DEF456",
        "eventID": "12345678-1234-1234-1234-111111111111",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111111111111",
      }

# ------ paired body: aws_s3_disable_bucket_logging.py ------

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context


def rule(event):
    return (
        aws_cloudtrail_success(event)
        and event.get("eventSource") == "s3.amazonaws.com"
        and event.get("eventName") == "PutBucketLogging"
        and event.deep_get("requestParameters", "logging") == ""
    )


def title(event):
    return (
        f"[AWS.CloudTrail] User [{event.udm('actor_user')}] "
        f"disabled bucket logging for bucket "
        f"[{event.deep_get('requestParameters', 'bucketName')}]"
    )


def alert_context(event):
    return aws_rule_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.