AWS S3 Bucket Hijacking: DeleteBucket Followed by Cross-Account CreateBucket for Replication Exfiltration

Thiru N@Iamthiru

•updated Jun 23, 2026•4•0•12

This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.