Cloud Storage Object Discovery `T1619`

Tactic: Discovery

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (19 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	5	`eq` 5	`aws.cloudtrail`, `azure.activitylogs`, `o365.audit`
`Provider_Name`	4	`eq` 4	`s3.amazonaws.com`, `SharePoint`
`event.outcome`	4	`eq` 4	`success`
`EventType`	3	`in` 2, `eq` 1	`SearchQueryPerformed`, `deleteobject`, `getbucketacl`, `getbucketpolicy`, `getbucketpolicystatus`
`aws::userIdentity.type`	3	`eq` 1, `in` 1, `ne` 1	`assumedrole`, `awsaccount`, `awsservice`, `unknown`
`Esql.aws_cloudtrail_resources_arn_count_distinct`	1	`gt` 1	`15`
`aws.cloudtrail.resources.arn`	1	`is_not_null` 1
`aws::errorCode`	1	`eq` 1	`accessdenied`
`aws::eventName`	1	`eq` 1	`listbuckets`
`aws::eventSource`	1	`eq` 1	`s3.amazonaws.com`
`aws::recipientAccountId`	1	`eq` 1	`anonymous`
`aws::sessionCredentialFromConsole`	1	`is_null` 1
`aws::userIdentity.arn`	1	`is_not_null` 1
`azure.activitylogs.operation_name`	1	`eq` 1	`microsoft.storage/storageaccounts/blobservices/containers/write`
`httpstatus`	1	`in` 1	`403`, `405`

Top indicator values (110 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAzure Blob Storage Container Access Level Modified elasticM365 SharePoint Search for Sensitive Content	4	369
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticAWS S3 Unauthenticated Bucket Access by Rare Source	3	15
`Provider_Name`	`eq`	`SharePoint` elasticM365 SharePoint Search for Sensitive Content	1
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticAWS S3 Unauthenticated Bucket Access by Rare Source	3	169
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Blob Storage Container Access Level Modified	1	39
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 SharePoint Search for Sensitive Content	1	47
`Esql.aws_cloudtrail_resources_arn_count_distinct`	`gt`	`15` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`eq`	`SearchQueryPerformed` elasticM365 SharePoint Search for Sensitive Content	1
`EventType`	`in`	`deleteobject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`getbucketacl` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`getbucketpolicy` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`getbucketpolicystatus` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`getbucketpublicaccessblock` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`getbucketversioning` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`getobject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`listbucket` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`listobjects` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`putobject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1	3
`aws::errorCode`	`eq`	`accessdenied` elasticAWS S3 Bucket Enumeration or Brute Force	1	16
`aws::eventName`	`eq`	`listbuckets` sigmaPotential Bucket Enumeration on AWS	1	2
`aws::eventSource`	`eq`	`s3.amazonaws.com` sigmaPotential Bucket Enumeration on AWS	1	17
`aws::recipientAccountId`	`eq`	`anonymous` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::userIdentity.type`	`eq`	`assumedrole` sigmaPotential Bucket Enumeration on AWS	1	9
`aws::userIdentity.type`	`in`	`awsaccount` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::userIdentity.type`	`in`	`unknown` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::userIdentity.type`	`ne`	`awsservice` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1	6
`azure.activitylogs.operation_name`	`eq`	`microsoft.storage/storageaccounts/blobservices/containers/write` elasticAzure Blob Storage Container Access Level Modified	1
`httpstatus`	`in`	`403` pantherAWS S3 Access Error	1
`httpstatus`	`in`	`405` pantherAWS S3 Access Error	1
`o365.audit.SearchQueryText`	`contains`	`1099` elasticM365 SharePoint Search for Sensitive Content	1

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userIdentity.type`	`eq`	`assumedrole` sigmaPotential Bucket Enumeration on AWS	1
`useragent`	`starts_with`	`aws-internal` pantherAWS S3 Access Error	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Sigma 1 rule

Potential Bucket Enumeration on AWS

Elastic 5 rules

Panther 1 rule

AWS S3 Access Error

Cloud Storage Object Discovery T1619