AWS S3 Object Versioning Suspended
Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten…
Description
Identifies when object versioning is suspended for an Amazon S3 bucket. Object versioning allows for multiple versions of an object to exist in the same bucket. This allows for easy recovery of deleted or overwritten objects. When object versioning is suspended for a bucket, it could indicate an adversary's attempt to inhibit system recovery following malicious activity. Additionally, when versioning is suspended, buckets can then be deleted.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
Detection requirements
- Platform
- ContainersESXiIaaSLinuxmacOSNetwork DevicesWindows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
- Log source category
- event_index
Known benign triggers
- Administrators within an AWS Organization structure may legitimately suspend object versioning. Ensure that this behavior is not part of a legitimate operation before taking action.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation/ | Only this detection cites it |
| docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketVersioning.html | 2 |
| docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html | Only this detection cites it |
| rhinosecuritylabs.com/aws/s3-ransomware-part-2-prevention-and-defense/ | Only this detection cites it |
| www.invictus-ir.com/news/ransomware-in-the-cloud/ | Only this detection cites it |
From the source
- At source
- Open at source
- Upstream identifier
- 30b5bb96-c7db-492c-80e9-1eab00db580b
- Tagged by the source as
- Data Source: Amazon Web ServicesData Source: AWSData Source: AWS CloudTrailDomain: CloudNoise: MediumPerformance: NormalPlatform: AWSProfile: RecommendedResources: Investigation GuideRule Type: Event Correlation (EQL)Service: AWS S3Tactic: ImpactThreat: Ransomware
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Oct 8, 2026
- Version
- 4