detection.wiki

Detection rules › Panther

AWS S3 Access Error

Severity
informational
Log types
AWS.S3ServerAccess
Tags
AWS, Security Control, Discovery:Cloud Storage Object Discovery
Reference
https://docs.aws.amazon.com/AmazonS3/latest/dev/ErrorCode.html
Source
github.com/panther-labs/panther-analysis

Checks for errors during S3 Object access. This could be due to insufficient access permissions, non-existent buckets, or other reasons.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1619 Cloud Storage Object Discovery

Rule body yaml

AnalysisType: rule
Filename: aws_s3_access_error.py
RuleID: "AWS.S3.ServerAccess.Error"
DisplayName: "AWS S3 Access Error"
DedupPeriodMinutes: 180
Threshold: 5
Enabled: true
LogTypes:
  - AWS.S3ServerAccess
Tags:
  - AWS
  - Security Control
  - Discovery:Cloud Storage Object Discovery
Reports:
  MITRE ATT&CK:
    - TA0007:T1619
Severity: Info
Description: >
  Checks for errors during S3 Object access.
  This could be due to insufficient access permissions, non-existent buckets, or other reasons.
Runbook: >
  Investigate the specific error and determine if it is an ongoing issue that needs to be addressed or a one off or transient error that can be ignored.
Reference: https://docs.aws.amazon.com/AmazonS3/latest/dev/ErrorCode.html
SummaryAttributes:
  - bucket
  - key
  - requester
  - remoteip
  - operation
  - errorCode
Tests:
  - Name: Amazon Access Error
    ExpectedResult: false
    Log:
      {
        "authenticationtype": "AuthHeader",
        "bucket": "cloudtrail",
        "bucketowner": "2c8e3610de4102c8e3610de4102c8e3610de410",
        "bytessent": 9438,
        "ciphersuite": "ECDHE-RSA-AES128-SHA",
        "errorcode": "SignatureDoesNotMatch",
        "hostheader": "cloudtrail.s3.us-west-2.amazonaws.com",
        "hostid": "2c8e3610de4102c8e3610de4102c8e3610de410",
        "httpstatus": 403,
        "key": "AWSLogs/o-3h3h3h3h3h/123456789012/CloudTrail/us-east-1/2020/06/21/123456789012_CloudTrail_us-east-1_20200621T2035Z_ZqQWc4WNXOQUiIic.json.gz",
        "operation": "REST.PUT.OBJECT",
        "remoteip": "54.159.198.108",
        "requestid": "8EFD962F22F2A510",
        "requesturi": "PUT /AWSLogs/o-wyibehgf3h/123456789012/CloudTrail/us-east-1/2020/06/21/123456789012_CloudTrail_us-east-1_20200621T2035Z_ZqQWc4WNXOQUiIic.json.gz HTTP/1.1",
        "signatureversion": "SigV4",
        "time": "2020-06-21 20:41:25.000000000",
        "tlsVersion": "TLSv1.2",
        "totaltime": 9,
        "useragent": "aws-internal/3",
      }
  - Name: Access Error
    ExpectedResult: true
    Log:
      {
        "bucket": "panther-auditlogs",
        "time": "2020-04-22 07:48:45.000",
        "remoteip": "10.106.38.245",
        "requester": "arn:aws:iam::162777425019:user/awslogsdelivery",
        "requestid": "5CDAB4038253B0E4",
        "operation": "REST.GET.OBJECT",
        "httpstatus": 403,
        "errorcode": "AccessDenied",
        "tlsversion": "TLSv1.2",
      }
  - Name: 403 on HEAD.BUCKET
    ExpectedResult: false
    Log:
      {
        "bucket": "panther-auditlogs",
        "time": "2020-04-22 07:48:45.000",
        "remoteip": "10.106.38.245",
        "requester": "arn:aws:iam::162777425019:user/awslogsdelivery",
        "requestid": "5CDAB4038253B0E4",
        "operation": "REST.HEAD.BUCKET",
        "httpstatus": 403,
        "errorcode": "InternalServerError",
        "tlsversion": "TLSv1.2",
      }
  - Name: Internal Server Error
    ExpectedResult: false
    Log:
      {
        "bucket": "panther-auditlogs",
        "time": "2020-04-22 07:48:45.000",
        "remoteip": "10.106.38.245",
        "requester": "arn:aws:iam::162777425019:user/awslogsdelivery",
        "requestid": "5CDAB4038253B0E4",
        "operation": "REST.HEAD.BUCKET",
        "httpstatus": 500,
        "errorcode": "InternalServerError",
        "tlsversion": "TLSv1.2",
      }

Detection logic

Condition

useragent not starts_with "aws-internal"
operation wildcard "REST.*.OBJECT"
httpstatus in ["403", "405"]

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
useragentstarts_withaws-internal

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
httpstatusin
  • 403
  • 405
operationwildcard
  • REST.*.OBJECT

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity
httpstatus
bucket