Potential Bucket Enumeration on AWS

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Source: github.com/SigmaHQ/sigma

Looks for potential enumeration of AWS buckets via ListBuckets.

Known false positives

Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1580` Cloud Infrastructure Discovery `T1619` Cloud Storage Object Discovery

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `ListBuckets`: Lists all S3 buckets owned by the authenticated requester.

Rules detecting the same action

These rules filter on the same operation.

AWS Discovery API Calls from VPN ASN for the First Time by Identity (Elastic)

Rule body

title: Potential Bucket Enumeration on AWS
id: f305fd62-beca-47da-ad95-7690a0620084
related:
    - id: 4723218f-2048-41f6-bcb0-417f2d784f61
      type: similar
status: test
description: Looks for potential enumeration of AWS buckets via ListBuckets.
references:
    - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
    - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
    - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
date: 2023-01-06
modified: 2024-07-10
tags:
    - attack.discovery
    - attack.t1580
    - attack.t1619
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 's3.amazonaws.com'
        eventName: 'ListBuckets'
    filter:
        userIdentity.type: 'AssumedRole'
    condition: selection and not filter
falsepositives:
    - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
level: low

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    eventSource: 's3.amazonaws.com'
    eventName: 'ListBuckets'

Stage 2: `not filter`

filter:
    userIdentity.type: 'AssumedRole'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`userIdentity.type`	eq	`AssumedRole`	`excludes:userIdentity.type` `field:"userIdentity.type" value:"AssumedRole"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`ListBuckets`	`field:"aws::eventName" kind:eq value:"ListBuckets"`
`eventSource`	eq	`s3.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"s3.amazonaws.com"`