Cloud Storage Object Discovery `T1619`

Tactic: Discovery

Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to File and Directory Discovery on a local host, after identifying available storage services (i.e. Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.

Authoring guide

These 7 rules share fields, values, and exclusions.

Fields filtered most (19 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	5	`eq` 5	`aws.cloudtrail`, `azure.activitylogs`, `o365.audit`
`Provider_Name`	4	`eq` 4	`s3.amazonaws.com`, `SharePoint`
`event.outcome`	4	`eq` 4	`success`, `Success`
`EventType`	3	`in` 2, `eq` 1	`DeleteObject`, `GetBucketAcl`, `GetBucketPolicy`, `GetBucketPolicyStatus`, `GetObject`
`aws::userIdentity.type`	3	`eq` 1, `in` 1, `ne` 1	`AWSAccount`, `AWSService`, `AssumedRole`, `Unknown`
`Esql.aws_cloudtrail_resources_arn_count_distinct`	1	`gt` 1	`15`
`aws.cloudtrail.resources.arn`	1	`is_not_null` 1
`aws::errorCode`	1	`eq` 1	`AccessDenied`
`aws::eventName`	1	`eq` 1	`ListBuckets`
`aws::eventSource`	1	`eq` 1	`s3.amazonaws.com`
`aws::recipientAccountId`	1	`eq` 1	`anonymous`
`aws::sessionCredentialFromConsole`	1	`is_null` 1
`aws::userIdentity.arn`	1	`is_not_null` 1
`azure.activitylogs.operation_name`	1	`eq` 1	`MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE`
`httpstatus`	1	`in` 1	`403`, `405`

Top indicator values (119 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Unauthenticated Bucket Access by Rare Source	2	8
`Provider_Name`	`eq`	`SharePoint` elasticM365 SharePoint Search for Sensitive Content	1
`Provider_Name`	`eq`	`s3.amazonaws.com` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1	8
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS S3 Bucket Enumeration or Brute Force elasticAWS S3 Unauthenticated Bucket Access by Rare Source	2	143
`event.outcome`	`eq`	`Success` elasticAWS S3 Unauthenticated Bucket Access by Rare Source elasticAzure Blob Storage Container Access Level Modified	2	306
`event.outcome`	`eq`	`success` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal elasticM365 SharePoint Search for Sensitive Content	2	82
`Esql.aws_cloudtrail_resources_arn_count_distinct`	`gt`	`15` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`eq`	`SearchQueryPerformed` elasticM365 SharePoint Search for Sensitive Content	1
`EventType`	`in`	`DeleteObject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`GetBucketAcl` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`GetBucketPolicy` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`GetBucketPolicyStatus` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`GetBucketPublicAccessBlock` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`GetBucketVersioning` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`EventType`	`in`	`GetObject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`ListBucket` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`ListObjects` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`EventType`	`in`	`PutObject` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1	3
`aws.cloudtrail.resources.arn`	`is_not_null`	elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1
`aws::errorCode`	`eq`	`AccessDenied` elasticAWS S3 Bucket Enumeration or Brute Force	1	16
`aws::eventName`	`eq`	`ListBuckets` sigmaPotential Bucket Enumeration on AWS	1	2
`aws::eventSource`	`eq`	`s3.amazonaws.com` sigmaPotential Bucket Enumeration on AWS	1	7
`aws::recipientAccountId`	`eq`	`anonymous` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::sessionCredentialFromConsole`	`is_null`	elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1	2
`aws::userIdentity.arn`	`is_not_null`	elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1	10
`aws::userIdentity.type`	`eq`	`AssumedRole` sigmaPotential Bucket Enumeration on AWS	1	8
`aws::userIdentity.type`	`in`	`AWSAccount` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::userIdentity.type`	`in`	`Unknown` elasticAWS S3 Unauthenticated Bucket Access by Rare Source	1
`aws::userIdentity.type`	`ne`	`AWSService` elasticAWS S3 Rapid Bucket Posture API Calls from a Single Principal	1	7
`azure.activitylogs.operation_name`	`eq`	`MICROSOFT.STORAGE/STORAGEACCOUNTS/BLOBSERVICES/CONTAINERS/WRITE` elasticAzure Blob Storage Container Access Level Modified	1

Exclusions (2 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userIdentity.type`	`eq`	`AssumedRole` sigmaPotential Bucket Enumeration on AWS	1
`useragent`	`starts_with`	`aws-internal` pantherAWS S3 Access Error	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Sigma 1 rule

Potential Bucket Enumeration on AWS

Elastic 5 rules

Panther 1 rule

AWS S3 Access Error

Cloud Storage Object Discovery T1619