AWSCloudTrail - S3 bucket exposed via ACL

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Detects S3 bucket ACL changes that grant public or broadly authenticated access. Overly permissive ACL assignments can expose bucket contents to unauthorized users.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1537` Transfer Data to Cloud Account

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `PutBucketAcl`: Sets the permissions on an existing S3 bucket using access control lists (ACLs).

Rules detecting the same action

These rules filter on the same operation.

AWS S3 Bucket Policy Modified (Panther)

Rule body

id: 6b9b4ee6-f4c1-4b86-8c8c-beb0bb59ae44
name: AWSCloudTrail - S3 bucket exposed via ACL
description: |
  Detects S3 bucket ACL changes that grant public or broadly authenticated access. Overly permissive ACL
  assignments can expose bucket contents to unauthorized users.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1537
query: |
  AWSCloudTrail
  | where EventName == "PutBucketAcl" and isempty(ErrorCode) and isempty(ErrorMessage)
  | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
  | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
  | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
  | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
  | extend Grant = parse_json(tostring((parse_json(RequestParameters).AccessControlPolicy))).AccessControlList.Grant
  | mvexpand Grant
  | extend cannedacl = parse_json(tostring((parse_json(RequestParameters))))
  | extend URI = parse_json(Grant).Grantee.URI, type = parse_json(Grant).Grantee.["xsi:type"], xamzacl = parse_json(cannedacl).["x-amz-acl"]
  | where (type == "Group" and (URI endswith "AllUsers" or URI endswith "AuthenticatedUsers"))
    or xamzacl in ("authenticated-read","public-read","public-read-write")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  URI: URI
  xamzacl: xamzacl
  RecipientAccountId: RecipientAccountId
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS S3 bucket ACL exposure change by {{AccountName}}'
  alertDescriptionFormat: 'Detected {{EventName}} from {{SourceIpAddress}} applying public or broad ACL on S3 bucket in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName == "PutBucketAcl" and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `extend` (5 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
| extend Grant = parse_json(tostring((parse_json(RequestParameters).AccessControlPolicy))).AccessControlList.Grant

Stage 4: `mv-expand`

| mvexpand Grant

Stage 5: `extend`

| extend cannedacl = parse_json(tostring((parse_json(RequestParameters))))

Stage 6: `extend`

| extend URI = parse_json(Grant).Grantee.URI, type = parse_json(Grant).Grantee.["xsi:type"], xamzacl = parse_json(cannedacl).["x-amz-acl"]

Stage 7: `where`

| where (type == "Group" and (URI endswith "AllUsers" or URI endswith "AuthenticatedUsers"))
  or xamzacl in ("authenticated-read","public-read","public-read-write")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	eq	`PutBucketAcl`	`field:"aws::eventName" kind:eq value:"PutBucketAcl"`
`URI`	ends_with	`AllUsers` `AuthenticatedUsers`	`field:"URI" kind:ends_with`
`type`	eq	`Group`	`field:"type" kind:eq value:"Group"`
`xamzacl`	in	`authenticated-read` `public-read` `public-read-write`	`field:"xamzacl" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`
`Grant`	`extend`
`cannedacl`	`extend`
`URI`	`extend`
`type`	`extend`
`xamzacl`	`extend`

AWSCloudTrail - S3 bucket exposed via ACL

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend (5 consecutive steps)

Stage 4: mv-expand

Stage 5: extend

Stage 6: extend

Stage 7: where