LoFP / disabling mfa delete when rotating the root account credentials used to manage versioning may trigger this rule. this operation requires root account credentials and is uncommon in automated pipelines.

Techniques

• T1490

Sample rules

AWS S3 Bucket MFA Delete Disabled

• source: elastic
• technicques:
  • T1490

Description

Detects when MFA Delete is disabled on an Amazon S3 bucket. MFA Delete is an additional layer of security for versioned S3 buckets that requires multi-factor authentication to permanently delete object versions or disable versioning. When MFA Delete is disabled, an adversary with S3 write access and a compromised long-term access key can permanently delete object versions, a critical step in ransomware attacks that target S3 versioning as a backup mechanism. MFA Delete is configured via PutBucketVersioning with the MfaDelete parameter set to Disabled.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketVersioning"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.VersioningConfiguration.MfaDelete: "Disabled"