AWSCloudTrail - S3 object publicly exposed

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Detects S3 object ACL changes that expose objects to public or broadly authenticated users. This can result in unintended data disclosure from object-level permissions.

MITRE ATT&CK coverage

Tactic	Techniques
Exfiltration	`T1537` Transfer Data to Cloud Account

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `PutObjectAcl`: End of support notice: As of October 1, 2025, Amazon S3 has discontinued support for Email Grantee Access Control Lists (ACLs).

Rules detecting the same action

These rules filter on the same operation.

S3 Access Via VPC Endpoint From External IP (Panther)

Rule body

id: 09f2a28b-3286-4268-9e2f-33805f104e5d
name: AWSCloudTrail - S3 object publicly exposed
description: |
  Detects S3 object ACL changes that expose objects to public or broadly authenticated users.
  This can result in unintended data disclosure from object-level permissions.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: AWS
    dataTypes:
      - AWSCloudTrail
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Exfiltration
relevantTechniques:
  - T1537
query: |
    AWSCloudTrail
      | where EventName == "PutObjectAcl" and isempty(ErrorCode) and isempty(ErrorMessage)
      | extend Grant = parse_json(tostring((parse_json(RequestParameters).AccessControlPolicy))).AccessControlList.Grant
      | mvexpand Grant
      | extend cannedacl = parse_json(tostring((parse_json(RequestParameters))))
      | extend URI = parse_json(Grant).Grantee.URI, type = parse_json(Grant).Grantee.["xsi:type"], xamzacl = parse_json(cannedacl).["x-amz-acl"]
      | where (type == "Group" and (URI endswith "AllUsers" or URI endswith "AuthenticatedUsers"))
        or xamzacl in ("authenticated-read","public-read","public-read-write")
      | extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
      | extend UserName = tostring(split(UserIdentityArn, '/')[-1])
      | extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
      | extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
        AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: UPNSuffix
        columnName: AccountUPNSuffix
      - identifier: CloudAppAccountId
        columnName: RecipientAccountId
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: SourceIpAddress
customDetails:
  EventName: EventName
  URI: URI
  xamzacl: xamzacl
  RecipientAccountId: RecipientAccountId
alertDetailsOverride:
  alertDisplayNameFormat: 'AWS S3 object public ACL exposure by {{AccountName}}'
  alertDescriptionFormat: 'Detected {{EventName}} event from {{SourceIpAddress}} applying public object ACL settings in account {{RecipientAccountId}}.'
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

AWSCloudTrail

Stage 2: `where`

| where EventName == "PutObjectAcl" and isempty(ErrorCode) and isempty(ErrorMessage)

Stage 3: `extend`

| extend Grant = parse_json(tostring((parse_json(RequestParameters).AccessControlPolicy))).AccessControlList.Grant

Stage 4: `mv-expand`

| mvexpand Grant

Stage 5: `extend`

| extend cannedacl = parse_json(tostring((parse_json(RequestParameters))))

Stage 6: `extend`

| extend URI = parse_json(Grant).Grantee.URI, type = parse_json(Grant).Grantee.["xsi:type"], xamzacl = parse_json(cannedacl).["x-amz-acl"]

Stage 7: `where`

| where (type == "Group" and (URI endswith "AllUsers" or URI endswith "AuthenticatedUsers"))
    or xamzacl in ("authenticated-read","public-read","public-read-write")

Stage 8: `extend` (4 consecutive steps)

| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
    AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ErrorCode`	is_null	(no value, null check)	`field:"aws::errorCode" kind:is_null`
`ErrorMessage`	is_null	(no value, null check)	`field:"aws::errorMessage" kind:is_null`
`EventName`	eq	`PutObjectAcl`	`field:"aws::eventName" kind:eq value:"PutObjectAcl"`
`URI`	ends_with	`AllUsers` `AuthenticatedUsers`	`field:"URI" kind:ends_with`
`type`	eq	`Group`	`field:"type" kind:eq value:"Group"`
`xamzacl`	in	`authenticated-read` `public-read` `public-read-write`	`field:"xamzacl" kind:in`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Grant`	`extend`
`cannedacl`	`extend`
`URI`	`extend`
`type`	`extend`
`xamzacl`	`extend`
`UserIdentityArn`	`extend`
`UserName`	`extend`
`AccountName`	`extend`
`AccountUPNSuffix`	`extend`

AWSCloudTrail - S3 object publicly exposed

MITRE ATT&CK coverage

Telemetry coverage

Rules detecting the same action

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: extend

Stage 4: mv-expand

Stage 5: extend

Stage 6: extend

Stage 7: where

Stage 8: extend (4 consecutive steps)