Universal Bucket Hijacking: Storage Bucket Deleted then Recreated for Stream Hijacking

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•4

Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.