AWS S3 Object Versioning Suspended
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "DETECTION_ACTION_AWS_S3_OBJECT_VERSIONING_SUSPENDED" select Action1.CALLER,Action1.HOSTNAME,Action1.IPADDRESS,Action1.LOG_EVENT_NAME,Action1.SOURCE,Action1.SOURCE_REGION,Action1.REQUESTPARAMETERS
Detection
Execution Mode
realtime
Log Sources
AWS
