This rule detects when MFA Delete is disabled for a versioned Amazon S3 bucket by monitoring AWS CloudTrail events. Specifically, it looks for PutBucketVersioning calls to s3.amazonaws.com where VersioningConfiguration.MfaDelete is set to Disabled and the event outcome is success. Since MFA Delete can only be configured by the AWS account root user, disabling it—especially by a non-root principal—can indicate credential compromise or unauthorized activity intended to erase version history and aid ransomware operations that target S3 backups. The detection uses the aws.cloudtrail dataset and filters on PutBucketVersioning with MfaDelete: Disabled. The rule is mapped to MITRE ATT&CK (T1490 Inhibit System Recovery) under the Impact tactic, highlighting its risk to data recoverability. It provides guidance that only root credentials can modify MFA Delete, so a non-root caller attempting this operation is treated as high-confidence unauthorized access, warranting immediate investigation. Triage considerations include verifying the caller identity (aws.cloudtrail.user_identity.type should be Root for legitimate changes), confirming the exact request_parameters (VersioningConfiguration={... MfaDelete=Disabled}), examining surrounding activity by the same identity for other destructive actions, and checking whether bucket versioning and MFA Delete remain enabled. If MFA Delete was indeed disabled, assess whether any object versions were permanently deleted and whether MFA was used for such requests. Remediate by re-enabling MFA Delete with root credentials, rotating credentials associated with the calling identity, reviewing for potential data loss, and implementing AWS Config rules to detect changes to versioning and MFA Delete configuration. References include AWS documentation on MFA Delete and PutBucketVersioning, plus guidance on AWS-centric ransomware attack vectors.