Mass deletion of versioned S3 objects

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490), Data Destruction (T1485)
Severity	Informational

Description

An identity deleted multiple S3 object versions at a high frequency, considerably more than usual. This may indicate an attempt to permanently purge historical versions to prevent data recovery, common in ransomware or malicious data destruction attacks.

Attacker's Goals

• Adversaries may delete data to prevent the recovery of a corrupted system.

• They may also aim to interrupt availability to resources.

Investigative actions

• Identify the deleted objects and their containing bucket.

• Investigate the identity performed the deletion and recent related activity.

Variations

Mass deletion of versioned S3 objects from a production account

Synopsis

Field	Value
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490), Data Destruction (T1485)
Severity	Low

Description

An identity deleted multiple S3 object versions from a production account at a high frequency, considerably more than usual. This may indicate an attempt to permanently purge historical versions to prevent data recovery, common in ransomware or malicious data destruction attacks.

Attacker's Goals

• Adversaries may delete data to prevent the recovery of a corrupted system.

• They may also aim to interrupt availability to resources.

Investigative actions

• Identify the deleted objects and their containing bucket.

• Investigate the identity performed the deletion and recent related activity.

Mass deletion of versioned S3 objects from a bucket containing sensitive data

Synopsis

Field	Value
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490), Data Destruction (T1485)
Severity	Low

Description

An identity deleted multiple S3 object versions from a bucket containing sensitive data, at a high frequency, considerably more than usual. This may indicate an attempt to permanently purge historical versions to prevent data recovery, common in ransomware or malicious data destruction attacks.

Attacker's Goals

• Adversaries may delete data to prevent the recovery of a corrupted system.

• They may also aim to interrupt availability to resources.

Investigative actions

• Identify the deleted objects and their containing bucket.

• Investigate the identity performed the deletion and recent related activity.

Mass deletion of versioned S3 objects deviating from the identity baseline

Synopsis

Field	Value
ATT&CK Tactic	Impact (TA0040)
ATT&CK Technique	Inhibit System Recovery (T1490), Data Destruction (T1485)
Severity	Informational

Description

An identity deleted multiple S3 object versions at a high frequency, considerably more than usual for that identity. This may indicate an attempt to permanently purge historical versions to prevent data recovery, common in ransomware or malicious data destruction attacks.

Attacker's Goals

• Adversaries may delete data to prevent the recovery of a corrupted system.

• They may also aim to interrupt availability to resources.

Investigative actions

• Identify the deleted objects and their containing bucket.

• Investigate the identity performed the deletion and recent related activity.