Anvilogic critical experimental other

AWS S3 Bucket Manipulation [snowflake-awscloudtrail]

Detect when various S3 bucket manipulation events occur within an AWS environment which can be indicative of malicious behavior being performed from a compromised account or an insider threat.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and ( event_name = 'PutBucketAcl' or event_name = 'PutBucketPolicy' or event_name = 'PutBucketCors' or event_name = 'PutBucketLifecycle' or event_name = 'PutBucketReplication' or event_name = 'DeleteBucketPolicy' or event_name = 'DeleteBucketCors' or event_name = 'DeleteBucketLifecycle' or event_name = 'DeleteBucketReplication' or event_name = 'DeleteBucket' )

Field Validations

Loading…

Comments (0)

Loading comments...