Detection rules › By event

AWS-s3

Event	Rules
any	1
CopyObject	6
DeleteAccountPublicAccessBlock	2
DeleteBucketCors	2
DeleteBucketEncryption	2
DeleteBucketLifecycle	2
DeleteBucketPolicy	2
DeleteBucketPublicAccessBlock	2
DeleteBucketReplication	3
DeleteObject	2
GetBucketAcl	1
GetBucketPolicy	1
GetBucketPolicyStatus	1
GetBucketPublicAccessBlock	1
GetBucketVersioning	1
GetObject	10
ListBucket	1
ListBuckets	2
ListObjects	1
PutAccountPublicAccessBlock	1
PutBucketAcl	6
PutBucketLifecycle	5
PutBucketLogging	4
PutBucketPolicy	4
PutBucketPublicAccessBlock	1
PutBucketReplication	3
PutBucketVersioning	7
PutBucketWebsite	1
PutEncryptionConfiguration	1
PutLifecycleConfiguration	1
PutObject	8
PutReplicationConfiguration	1
ReplicateObject	1
RestoreObject	1
DeleteObjects	2
GetObjectAcl	1
PutBucketCors	1
PutObjectAcl	2
PutAccessPointPolicy	1

any

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Enumeration or Brute Force severity low T1530, T1580, T1619, T1657

CopyObject

6 detection rules reference this event. View event page.

Elastic (3)

AWS S3 Object Encryption Using External KMS Key severity medium T1486
Excessive AWS S3 Object Encryption with SSE-C severity high T1486
Unusual AWS S3 Object Encryption with SSE-C severity high T1078, T1078.004, T1486

Splunk (1)

AWS Detect Users with KMS keys performing encryption S3 severity low T1486

Panther (2)

AWS S3 Copy Object with Client-Side Encryption severity medium
S3 Access Via VPC Endpoint From External IP severity medium

DeleteAccountPublicAccessBlock

2 detection rules reference this event. View event page.

YARA-L (1)

AWS S3 Public Access Block Removed severity high T1685

Panther (1)

Account Security Configuration Changed severity medium T1685

DeleteBucketCors

2 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Configuration Deletion severity low T1070, T1490, T1685, T1685.002

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

DeleteBucketEncryption

2 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Configuration Deletion severity low T1070, T1490, T1685, T1685.002

Panther (1)

S3 Bucket Encryption Deleted severity medium T1485, T1685

DeleteBucketLifecycle

2 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Configuration Deletion severity low T1070, T1490, T1685, T1685.002

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

DeleteBucketPolicy

2 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Configuration Deletion severity low T1070, T1490, T1685, T1685.002

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

DeleteBucketPublicAccessBlock

2 detection rules reference this event. View event page.

YARA-L (1)

AWS S3 Public Access Block Removed severity high T1685

Panther (1)

S3 Public Access Block Deleted severity medium T1190, T1685

DeleteBucketReplication

3 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Configuration Deletion severity low T1070, T1490, T1685, T1685.002

Panther (2)

AWS S3 Bucket Policy Modified severity informational T1567
S3 Bucket Replication Deleted severity medium T1485, T1685

DeleteObject

2 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Unauthenticated Bucket Access by Rare Source severity medium T1485, T1530, T1565, T1565.001, T1619

Panther (1)

AWS S3 Delete Object Detection severity informational

GetBucketAcl

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Rapid Bucket Posture API Calls from a Single Principal severity low T1526, T1530, T1580, T1619

GetBucketPolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Rapid Bucket Posture API Calls from a Single Principal severity low T1526, T1530, T1580, T1619

GetBucketPolicyStatus

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Rapid Bucket Posture API Calls from a Single Principal severity low T1526, T1530, T1580, T1619

GetBucketPublicAccessBlock

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Rapid Bucket Posture API Calls from a Single Principal severity low T1526, T1530, T1580, T1619

GetBucketVersioning

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Rapid Bucket Posture API Calls from a Single Principal severity low T1526, T1530, T1580, T1619

GetObject

10 detection rules reference this event. View event page.

Elastic (2)

AWS S3 Credential File Retrieved from Bucket severity medium T1530, T1552, T1552.001
AWS S3 Unauthenticated Bucket Access by Rare Source severity medium T1485, T1530, T1565, T1565.001, T1619

Splunk (1)

AWS Exfiltration via Anomalous GetObject API Activity severity low T1119

Kusto (4)

AWSCloudTrail - S3 bucket suspicious ransomware activity severity high T1486
AWSCloudTrail - S3 Object Exfiltration from Anonymous User severity medium T1530
AWSCloudTrail - Successful brute force attack on S3 Bucket severity high T1110
Suspicious access of BEC related documents in AWS S3 buckets severity medium T1530

Panther (3)

AWS S3 Large Download severity informational T1537
AWS S3 Large Download
S3 Access Via VPC Endpoint From External IP severity medium

ListBucket

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Unauthenticated Bucket Access by Rare Source severity medium T1485, T1530, T1565, T1565.001, T1619

ListBuckets

2 detection rules reference this event. View event page.

Sigma (1)

Potential Bucket Enumeration on AWS severity low T1580, T1619

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

ListObjects

1 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Unauthenticated Bucket Access by Rare Source severity medium T1485, T1530, T1565, T1565.001, T1619

PutAccountPublicAccessBlock

1 detection rules reference this event. View event page.

YARA-L (1)

AWS S3 Public Access Block Removed severity high T1685

PutBucketAcl

6 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket ACL Modified to Allow Public Access by New Identity severity medium T1530

Splunk (2)

Detect New Open S3 buckets severity medium T1530
Detect New Open S3 Buckets over AWS CLI severity medium T1530

Kusto (1)

AWSCloudTrail - S3 bucket exposed via ACL severity medium T1537

YARA-L (1)

AWS S3 Bucket Made Public By ACL severity high T1685

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

PutBucketLifecycle

5 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Expiration Lifecycle Configuration Added severity low T1070, T1485, T1485.001, T1685, T1685.002

Splunk (2)

Panther (2)

AWS CloudTrail Retention Lifecycle Too Short severity informational T1685.002
AWS S3 Bucket Policy Modified severity informational T1567

PutBucketLogging

4 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

Elastic (1)

AWS S3 Bucket Server Access Logging Disabled severity high T1685, T1685.002

Panther (2)

AWS S3 Security Control Disabling severity high T1485, T1685
S3 Bucket Logging Disabled severity low T1485, T1685

PutBucketPolicy

4 detection rules reference this event. View event page.

Elastic (2)

AWS S3 Bucket Policy Added to Allow Public Access severity medium T1530, T1537
AWS S3 Bucket Policy Added to Share with External Account severity medium T1098, T1530, T1537

Kusto (1)

AWSCloudTrail - S3 bucket exposed via policy severity medium T1537

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

PutBucketPublicAccessBlock

1 detection rules reference this event. View event page.

YARA-L (1)

AWS S3 Public Access Block Removed severity high T1685

PutBucketReplication

3 detection rules reference this event. View event page.

Elastic (1)

AWS S3 Bucket Replicated to Another Account severity high T1537, T1567, T1567.002

Splunk (1)

AWS Exfiltration via Bucket Replication severity medium T1537

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

PutBucketVersioning

7 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Bucket Versioning Disable severity medium T1490

Elastic (1)

AWS S3 Object Versioning Suspended severity medium T1490

Splunk (2)

ASL AWS Disable Bucket Versioning severity low T1490
AWS Disable Bucket Versioning severity low T1490

Panther (3)

AWS S3 Security Control Disabling severity high T1485, T1685
S3 Bucket Versioning Suspended severity low T1485, T1685
S3 MFA Delete Disabled severity low T1485, T1685

PutBucketWebsite

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

PutEncryptionConfiguration

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

PutLifecycleConfiguration

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

PutObject

8 detection rules reference this event. View event page.

Elastic (5)

AWS S3 Static Site JavaScript File Uploaded severity high T1491, T1491.002, T1565, T1565.001
AWS S3 Unauthenticated Bucket Access by Rare Source severity medium T1485, T1530, T1565, T1565.001, T1619
Excessive AWS S3 Object Encryption with SSE-C severity high T1486
Potential AWS S3 Bucket Ransomware Note Uploaded severity medium T1485, T1486, T1565, T1565.001
Unusual AWS S3 Object Encryption with SSE-C severity high T1078, T1078.004, T1486

Kusto (2)

AWSCloudTrail - S3 bucket suspicious ransomware activity severity high T1486
AWSCloudTrail - Suspicious command sent to EC2 severity high T1651

Panther (1)

S3 Access Via VPC Endpoint From External IP severity medium

PutReplicationConfiguration

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

ReplicateObject

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

RestoreObject

1 detection rules reference this event. View event page.

Sigma (1)

AWS S3 Data Management Tampering severity low T1537

DeleteObjects

2 detection rules reference this event. View event page.

Panther (2)

AWS S3 Delete Objects Detection severity informational
S3 Access Via VPC Endpoint From External IP severity medium

GetObjectAcl

1 detection rules reference this event. View event page.

Panther (1)

S3 Access Via VPC Endpoint From External IP severity medium

PutBucketCors

1 detection rules reference this event. View event page.

Panther (1)

AWS S3 Bucket Policy Modified severity informational T1567

PutObjectAcl

2 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - S3 object publicly exposed severity medium T1537

Panther (1)

S3 Access Via VPC Endpoint From External IP severity medium

PutAccessPointPolicy

1 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - S3 bucket access point publicly exposed severity medium T1537