{"id":"a136ac98-b2bc-4189-a14d-f0d0388e57a7","title":"AWS S3 Bucket Versioning Disable","description":"Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.","author":"Sean Johnstone | Unit 42","status":"test","level":"medium","date":"2023-10-28","modified":"","tags":["attack.impact","attack.t1490"],"technique_ids":["T1490"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["AWS administrator legitimately disabling bucket versioning"],"references":["https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82"],"source_path":"rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml","source_sha256":"d8878bcfa1527168cbbdb87ac1485f3cf3289aaac9aa163eb372305bcb672142","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: AWS S3 Bucket Versioning Disable\nid: a136ac98-b2bc-4189-a14d-f0d0388e57a7\nstatus: test\ndescription: Detects when S3 bucket versioning is disabled. Threat actors use this technique during AWS ransomware incidents prior to deleting S3 objects.\nreferences:\n    - https://invictus-ir.medium.com/ransomware-in-the-cloud-7f14805bbe82\nauthor: Sean Johnstone | Unit 42\ndate: 2023-10-28\ntags:\n    - attack.impact\n    - attack.t1490\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: s3.amazonaws.com\n        eventName: PutBucketVersioning\n        requestParameters|contains: 'Suspended'\n    condition: selection\nfalsepositives:\n    - AWS administrator legitimately disabling bucket versioning\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1490","id":"T1490","name":"Inhibit System Recovery","page":"techniques/enterprise/T1490/"}],"data_path":"data/detection-rules/a136ac98-b2bc-4189-a14d-f0d0388e57a7.json","kind":"sigma"}