Potential Bucket Enumeration on AWS — Sigma Rule

Rule metadata and linked tags

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io. Source status: test; severity: low. Source dates: 2023-01-06 / 2024-07-10.

{
  "product": "aws",
  "service": "cloudtrail"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 9aa68b0fe446f30c162e50a3e9a9f3985a63a4ec8a1a5c2f5d1586c26f72bfbd

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Potential Bucket Enumeration on AWS
id: f305fd62-beca-47da-ad95-7690a0620084
related:
    - id: 4723218f-2048-41f6-bcb0-417f2d784f61
      type: similar
status: test
description: Looks for potential enumeration of AWS buckets via ListBuckets.
references:
    - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
    - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
    - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
date: 2023-01-06
modified: 2024-07-10
tags:
    - attack.discovery
    - attack.t1580
    - attack.t1619
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 's3.amazonaws.com'
        eventName: 'ListBuckets'
    filter:
        userIdentity.type: 'AssumedRole'
    condition: selection and not filter
falsepositives:
    - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
level: low

Original YAML and metadata in JSON

False positives

• Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.

Source references

• https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
• https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
• https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/