AWS S3 Security Control Disabling

Description

Detects the disabling of 2 or more distinct S3 security controls (logging, versioning, and MFA delete protection) on the same bucket by the same actor within a short timeframe. Threshold is set to 2 rather than 3 because versioning and MFA delete can be disabled together in a single PutBucketVersioning API call, which produces only one unique value — making a threshold of 3 structurally unreachable in that scenario. This pattern is a strong indicator of preparation for ransomware or data destruction attacks, as attackers typically disable recovery mechanisms before encrypting or deleting data.

Query · python

from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context


def rule(event):
    if not aws_cloudtrail_success(event):
        return False
    if event.get("eventSource") != "s3.amazonaws.com":
        return False

    event_name = event.get("eventName")

    if event_name == "PutBucketLogging":
        return event.deep_get("requestParameters", "logging") == ""

    if event_name == "PutBucketVersioning":
        status = event.deep_get(
            "requestParameters", "VersioningConfiguration", "Status", default=""
        )
        mfa_delete = event.deep_get(
            "requestParameters", "VersioningConfiguration", "MfaDelete", default=""
        )
        return status in ("Suspended", "Disabled") or mfa_delete == "Disabled"

    return False


def unique(event):
    if event.get("eventName") == "PutBucketLogging":
        return "logging_disabled"

    # PutBucketVersioning — both versioning and MFA delete can be disabled in a single API call.
    # When that happens this event contributes only one unique value, capping the maximum
    # distinct values at 2 (this + logging_disabled). Threshold is set to 2 so the rule
    # fires correctly even when all three controls are disabled via just two API calls.
    status = event.deep_get("requestParameters", "VersioningConfiguration", "Status", default="")
    mfa_delete = event.deep_get(
        "requestParameters", "VersioningConfiguration", "MfaDelete", default=""
    )
    versioning_disabled = status in ("Suspended", "Disabled")
    mfa_disabled = mfa_delete == "Disabled"

    if versioning_disabled and mfa_disabled:
        return "versioning_and_mfa_disabled"
    if versioning_disabled:
        return "versioning_suspended"
    return "mfa_delete_disabled"


def dedup(event):
    bucket = event.deep_get("requestParameters", "bucketName", default="UNKNOWN_BUCKET")
    actor = event.deep_get("userIdentity", "arn", default="UNKNOWN_ACTOR")
    return f"{bucket}:{actor}"


def title(event):
    bucket = event.deep_get("requestParameters", "bucketName", default="UNKNOWN_BUCKET")
    actor = event.udm("actor_user")
    return f"[AWS.S3] Multiple security controls disabled on bucket [{bucket}] by [{actor}]"


def alert_context(event):
    context = aws_rule_context(event)
    context["bucketName"] = event.deep_get(
        "requestParameters", "bucketName", default="UNKNOWN_BUCKET"
    )
    return context

Analyst notes

Query CloudTrail for all S3 API calls by the actor ARN on the affected bucket in the 24 hours before and after the bucket logging was disabled to identify if this is part of a larger attack pattern
Check for subsequent suspicious activities on the same bucket including DeleteObject, DeleteObjects, PutBucketEncryption, or GetObject events in the 6 hours after all three security controls were disabled
Find all other S3 buckets where this actor ARN has disabled logging, versioning, or MFA delete in the past 7 days to determine if this is a widespread attack

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: High
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-04-20
Authored by: panther-labs
Source ID
Upstream: rules/aws_cloudtrail_rules/aws_s3_security_control_disabling.yml
Type: rule
Version: 1
References: https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
Data sources: AWS.CloudTrail

ATT&CK

TA0005TA0040 T1485 T1562