detection.wiki

Detection rules › Sigma

AWS S3 Data Management Tampering

Status
test
Severity
low
Log source
product aws, service cloudtrail
Author
Austin Songer @austinsonger
Source
github.com/SigmaHQ/sigma

Detects when a user tampers with S3 data management in Amazon Web Services.

Known false positives

  • A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK coverage

TacticTechniques
Exfiltration

Telemetry coverage

PlatformRecord / event type
AWSCloudTrail event PutBucketLogging: Sets the logging parameters for a specified S3 bucket.
AWSCloudTrail event PutBucketWebsite: Sets the configuration of the website for a specified S3 bucket.
AWSCloudTrail event PutEncryptionConfiguration: Sets the default server-side encryption configuration for a specified S3 bucket.
AWSCloudTrail event PutLifecycleConfiguration: Creates or replaces the lifecycle configuration for a specified S3 bucket.
AWSCloudTrail event PutReplicationConfiguration: Creates or replaces the replication configuration for a specified S3 bucket.
AWSCloudTrail event ReplicateObject: Replicates an object to a destination bucket as part of a replication configuration.
AWSCloudTrail event RestoreObject: Restores a temporarily deleted or archived object in a specified S3 bucket.

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: AWS S3 Data Management Tampering
id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
status: test
description: Detects when a user tampers with S3 data management in Amazon Web Services.
references:
    - https://github.com/elastic/detection-rules/pull/1145/files
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
author: Austin Songer @austinsonger
date: 2021-07-24
modified: 2022-10-09
tags:
    - attack.exfiltration
    - attack.t1537
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: s3.amazonaws.com
        eventName:
            - PutBucketLogging
            - PutBucketWebsite
            - PutEncryptionConfiguration
            - PutLifecycleConfiguration
            - PutReplicationConfiguration
            - ReplicateObject
            - RestoreObject
    condition: selection
falsepositives:
    - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    eventSource: s3.amazonaws.com
    eventName:
        - PutBucketLogging
        - PutBucketWebsite
        - PutEncryptionConfiguration
        - PutLifecycleConfiguration
        - PutReplicationConfiguration
        - ReplicateObject
        - RestoreObject

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
eventNameeq
  • PutBucketLogging
  • PutBucketWebsite
  • PutEncryptionConfiguration
  • PutLifecycleConfiguration
  • PutReplicationConfiguration
  • ReplicateObject
  • RestoreObject
field:"aws::eventName" kind:eq
eventSourceeq
  • s3.amazonaws.com
field:"aws::eventSource" kind:eq value:"s3.amazonaws.com"