S3 Bucket Deletion Followed by Firehose Delivery Stream Creation to Hijacked Bucket

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Detects a potential S3 bucket hijacking attempt where an S3 bucket is deleted and shortly after, an AWS Firehose delivery stream is created or updated to target a bucket with the same name, but under a different AWS account. This could indicate an adversary attempting to exfiltrate data by redirecting data intended for the original bucket to their own controlled bucket.