Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Detect Spike in S3 Bucket deletion

The following analytic identifies a spike in API activity related to the deletion of S3 buckets in your AWS environment. It leverages AWS CloudTrail logs to detect anomalies by comparing current deletion activity against a historical baseline. This activity is significant as unusual spikes in S3 bucket deletions could indicate malicious actions such as data exfiltration or unauthorized data destruction. If confirmed malicious, this could lead to significant data loss, disruption of services, and potential exposure of sensitive information. Immediate investigation is required to determine the legitimacy of the activity.

ATT&CK coverage

Outside the enterprise matrix

T1530

Detection requirements

Log source category: aws_cloudtrail

What the source says

What fires this without an attack behind it

Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment.

Tagged by the source as

Suspicious AWS S3 ActivitiesS3 BucketcloudSplunk CloudSplunk EnterpriseSplunk Enterprise Securitynetwork

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.