S3 Bucket Lifecycle Policy Set for Auto-Deletion

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.