[New Rule] AWS S3 Bucket Expiration Lifecycle Configuration Added

[Mikaayenson]

Issues

• https://github.com/elastic/ia-trade-team/issues/358
• Readded from [New Rule] AWS S3 Bucket Expiration Lifecycle Configuration Added #3591 (created by @terrancedejesus) (due to maintenance, without backport: auto)

Summary

Identifies an expiration lifecycle configuration added to an S3 bucket. Lifecycle configurations can be used to manage
objects in a bucket, including setting expiration policies. This rule detects when a lifecycle configuration is added to
an S3 bucket, which could indicate that objects in the bucket will be automatically deleted after a specified period of
time. This could be used to evade detection by deleting objects that contain evidence of malicious activity.

Example Data

{
  "_index": ".ds-logs-aws.cloudtrail-default-2024.04.09-000001",
  "_id": "f1aed5137a-000000035243",
  "_version": 1,
  "_score": 0,
  "_source": {
    "agent": {
      "name": "ip-172-31-95-103",
      "id": "agent-id",
      "type": "filebeat",
      "ephemeral_id": "ephemeral-id",
      "version": "8.13.2"
    },
    "log": {
      "file": {
        "path": "https://bucket-name.s3.region.amazonaws.com/AWSLogs/bucket-name/CloudTrail/region/2024/04/12/log-file-name.json.gz"
      },
      "offset": 35243
    },
    "elastic_agent": {
      "id": "agent-id",
      "version": "8.13.2",
      "snapshot": false
    },
    "source": {
      "geo": {
        "continent_name": "North America",
        "region_iso_code": "US-OH",
        "city_name": "City",
        "country_iso_code": "US",
        "country_name": "United States",
        "region_name": "State",
        "location": {
          "lon": -xx.xxxx,
          "lat": xx.xxxx
        }
      },
      "as": {
        "number": 12097,
        "organization": {
          "name": "Organization Name"
        }
      },
      "address": "IP Address",
      "ip": "IP Address"
    },
    "cloud": {
      "region": "us-east-1"
    },
    "input": {
      "type": "aws-s3"
    },
    "@timestamp": "2024-04-12T17:06:42.000Z",
    "ecs": {
      "version": "8.0.0"
    },
    "related": {
      "user": ["username"]
    },
    "data_stream": {
      "namespace": "default",
      "type": "logs",
      "dataset": "aws.cloudtrail"
    },
    "tls": {
      "cipher": "TLS_AES_128_GCM_SHA256",
      "client": {
        "server_name": "bucket-name.s3.region.amazonaws.com"
      },
      "version": "1.3",
      "version_protocol": "tls"
    },
    "aws": {
      "s3": {
        "bucket": {
          "name": "bucket-name",
          "arn": "arn:aws:s3:::bucket-name"
        },
        "object": {
          "key": "AWSLogs/bucket-name/CloudTrail/region/2024/04/12/log-file-name.json.gz"
        }
      },
      "cloudtrail": {
        "event_version": "1.09",
        "request_parameters": {
          "bucketName": "bucket-name",
          "LifecycleConfiguration": {
            "Rule": {
              "Status": "Enabled",
              "Filter": {
                "Prefix": "*"
              },
              "Expiration": {
                "Days": 1
              },
              "ID": "config-id"
            },
            "Host": "bucket-name.s3.region.amazonaws.com"
          }
        },
        "event_type": "AwsApiCall",
        "user_identity": {
          "type": "IAMUser",
          "arn": "arn:aws:iam::account-id:user/username"
        },
        "event_category": "Management",
        "request_id": "request-id"
      }
    },
    "event": {
      "agent_id_status": "verified",
      "provider": "s3.amazonaws.com",
      "action": "PutBucketLifecycle",
      "id": "event-id",
      "type": ["info"],
      "dataset": "aws.cloudtrail",
      "outcome": "success"
    },
    "user": {
      "name": "username",
      "id": "user-id"
    },
    "user_agent": {
      "original": "user-agent-string",
      "name": "Other",
      "device": {
        "name": "Other"
      }
    }
  }
}