{"id":"f305fd62-beca-47da-ad95-7690a0620084","title":"Potential Bucket Enumeration on AWS","description":"Looks for potential enumeration of AWS buckets via ListBuckets.","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io","status":"test","level":"low","date":"2023-01-06","modified":"2024-07-10","tags":["attack.discovery","attack.t1580","attack.t1619"],"technique_ids":["T1580","T1619"],"logsource":{"product":"aws","service":"cloudtrail"},"falsepositives":["Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity."],"references":["https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md","https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html","https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/"],"source_path":"rules/cloud/aws/cloudtrail/aws_enum_buckets.yml","source_sha256":"9aa68b0fe446f30c162e50a3e9a9f3985a63a4ec8a1a5c2f5d1586c26f72bfbd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Bucket Enumeration on AWS\nid: f305fd62-beca-47da-ad95-7690a0620084\nrelated:\n    - id: 4723218f-2048-41f6-bcb0-417f2d784f61\n      type: similar\nstatus: test\ndescription: Looks for potential enumeration of AWS buckets via ListBuckets.\nreferences:\n    - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md\n    - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html\n    - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/\nauthor: Christopher Peacock @securepeacock, SCYTHE @scythe_io\ndate: 2023-01-06\nmodified: 2024-07-10\ntags:\n    - attack.discovery\n    - attack.t1580\n    - attack.t1619\nlogsource:\n    product: aws\n    service: cloudtrail\ndetection:\n    selection:\n        eventSource: 's3.amazonaws.com'\n        eventName: 'ListBuckets'\n    filter:\n        userIdentity.type: 'AssumedRole'\n    condition: selection and not filter\nfalsepositives:\n    - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1580","id":"T1580","name":"Cloud Infrastructure Discovery","page":"techniques/enterprise/T1580/"},{"key":"enterprise/T1619","id":"T1619","name":"Cloud Storage Object Discovery","page":"techniques/enterprise/T1619/"}],"data_path":"data/detection-rules/f305fd62-beca-47da-ad95-7690a0620084.json","kind":"sigma"}