Elastic high stable eql

AWS S3 Bucket Replicated to Another Account

Identifies the creation or modification of an S3 bucket replication configuration that sends data to a bucket in a different AWS account. Cross-account replication can be used legitimately for backup, disaster recovery, and multi-account architectures, but adversaries with write access to an S3 bucket may abuse replication rules to silently exfiltrate large volumes of data to attacker-controlled accounts. This rule detects "PutBucketReplication" events where the configured destination account differs from the source bucket's account, indicating potential unauthorized cross-account data movement.

View Source

Detection Logic

info where data_stream.dataset == "aws.cloudtrail"
   and event.action == "PutBucketReplication"
   and event.outcome == "success"
   and stringContains(aws.cloudtrail.request_parameters, "Account=")
   and not user_agent.original like~ ("*Terraform*", "*Pulumi*")

False Positives

⚠ Cross-account S3 replication is common in multi-account AWS Organizations, centralized logging architectures, and disaster-recovery designs. Confirm whether the destination account is an approved replication target. Unexpected replication configuration changes should be treated as suspicious.

Field Validations

Loading…

Comments (0)

Loading comments...