Try in Splunk Security Cloud

Description

The following analytic detects when AWS S3 bucket versioning is suspended by a user. It leverages AWS CloudTrail logs to identify PutBucketVersioning events with the VersioningConfiguration.Status set to Suspended. This activity is significant because disabling versioning can prevent recovery of deleted or modified data, which is a common tactic in ransomware attacks. If confirmed malicious, this action could lead to data loss and hinder recovery efforts, severely impacting data integrity and availability.

  • Type: Anomaly

  • Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

  • Last Updated: 2024-05-24
  • Author: Bhavin Patel, Splunk
  • ID: 657902a9-987d-4879-a1b2-e7a65512824b

Annotations

ATT&CK

ATT&CK

ID Technique Tactic
T1490 Inhibit System Recovery Impact
Kill Chain Phase
  • Actions On Objectives
NIST
  • DE.AE
CIS20
  • CIS 10
CVE 


1
2
3
4
5



`cloudtrail` eventName= PutBucketVersioning "requestParameters.VersioningConfiguration.Status"=Suspended 
|  stats count values(requestParameters.bucketName) as bucket_name values(resources{}.ARN) as resource_arn by src_ip aws_account_id awsRegion eventName userAgent user_arn userIdentity.principalId  errorCode 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)`
| `aws_disable_bucket_versioning_filter`

Macros

The SPL above uses the following Macros:

:information_source: aws_disable_bucket_versioning_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

  • _time
  • eventName
  • user_arn
  • src_ip
  • aws_account_id
  • destinationLocationArn
  • sourceLocationArn
  • userAgent
  • userIdentity.principalId

How To Implement

You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.

Known False Positives

It is possible that an AWS Administrator has legitimately disabled versioning on certain buckets to avoid costs.

Associated Analytic Story

RBA

Risk Score Impact Confidence Message
64.0 80 80 Bucket Versioning is suspended for S3 buckets- $bucket_name$ by user $user_arn$ from IP address $src_ip$

:information_source: The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 2