S3 Bucket Logging Deletion from Non-AWS Infrastructure
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
Cortex XDR
