Try in Splunk Security Cloud

Description

The following analytic detects AWS cloudtrail events where bucket versioning is suspended by a user. Versioning allows the AWS Administrators to maintain different version of the S3 bucket which can be used to recover deleted data. Adversaries have leveraged this technique in the wild during a ransomware incident to disable versioning so the client cannot recover the data.

  • Type: Anomaly

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2023-05-01
  • Author: Bhavin Patel, Splunk
  • ID: 657902a9-987d-4879-a1b2-e7a65512824b

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1490 Inhibit System Recovery Impact
Kill Chain Phase
  • Actions On Objectives
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5



`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended 
|  stats count values(requestParameters.bucketName) as bucket_name values(resources{}.ARN) as resource_arn by src_ip aws_account_id awsRegion eventName userAgent user_arn userIdentity.principalId  errorCode 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `aws_disable_bucket_versioning_filter`

Macros

The SPL above uses the following Macros:

:information_source: aws_disable_bucket_versioning_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • eventName
  • user_arn
  • src_ip
  • aws_account_id
  • destinationLocationArn
  • sourceLocationArn
  • userAgent
  • userIdentity.principalId

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

Known False Positives

It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
64.0 80 80 Bucket Versioning is suspended for S3 buckets- $bucket_name$ by user $user_arn$ from IP address $src_ip$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1