AWS S3 Bucket MFA Delete Disabled

Detects when MFA Delete is disabled on an Amazon S3 bucket. MFA Delete is an additional layer of security for versioned S3 buckets that requires multi-factor authentication to permanently delete object versions or disable versioning. When MFA Delete is disabled, an adversary with S3 write access and a compromised long-term access key can permanently delete object versions, a critical step in ransomware attacks that target S3 versioning as a backup mechanism. MFA Delete is configured via PutBucketVersioning with the MfaDelete parameter set to Disabled.

Rule type: query
Rule indices:

  • logs-aws.cloudtrail-*

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-6m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Platform: AWS
  • Data Source: AWS CloudTrail
  • Service: AWS S3
  • Rule Type: Custom Query (KQL)
  • Tactic: Impact
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
The AWS integration must be ingesting management events into logs-aws.cloudtrail-*. S3 management events are logged by default.

MFA Delete protects versioned S3 buckets by requiring MFA authentication to permanently delete object versions or change the versioning state. This protection is specifically designed to prevent ransomware from destroying version history after encrypting the current object copies. Disabling MFA Delete removes this safeguard and is a recognized ransomware preparation step.

Importantly, only the AWS account root user can enable or disable MFA Delete. A PutBucketVersioning call disabling MFA Delete from a non-root identity is a strong indicator of root credential compromise or unauthorized use.

  • Identify the caller from aws.cloudtrail.user_identity.type. If this is not a Root identity, treat it as high-confidence unauthorized access.
  • Check aws.cloudtrail.request_parameters to confirm VersioningConfiguration={... MfaDelete=Disabled} is present.
  • Review all API calls by the same identity in the surrounding window for other data-destruction or encryption-related actions.
  • Check whether object versioning remains enabled on the affected bucket. If both versioning and MFA Delete are disabled, the bucket has no object-level recovery protection.
  • Investigate whether MFA was presented (aws.cloudtrail.additional_eventdata contains MFA information for requests that required it).
  • If unauthorized, immediately re-enable MFA Delete using root credentials and verify that object version history is intact.
  • Rotate all credentials associated with the calling identity.
  • Review S3 object versions for any permanent deletions that occurred after MFA Delete was disabled.
  • Enable AWS Config rules to detect versioning and MFA Delete configuration changes.
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "s3.amazonaws.com"
    and event.action: "PutBucketVersioning"
    and event.outcome: "success"
    and aws.cloudtrail.flattened.request_parameters.VersioningConfiguration.MfaDelete: "Disabled"

Framework: MITRE ATT&CK