S3 Bucket Hijacking: DeleteBucket Followed by Cross-Account CreateBucket
This rule detects a potential AWS S3 bucket name hijacking scenario. It looks for instances where an S3 bucket is deleted and then a new bucket with the exact same name is created within a short time frame (up to 1 hour) by a *different* AWS account. This pattern can be used to hijack S3 replication rule destinations, enabling silent data exfiltration to an attacker-controlled account. The rule also attempts to identify if the original bucket had replication configured.
Microsoft Sentinel (KQL)
