SEKOIA.IO Rules medium stable sigma

AWS CloudTrail S3 Bucket Replication

Detects a replication rule being enable for a given S3 bucket: it could provide an attacker a way to exfiltrate data.

View Source

Detection Logic

selection:
  sekoiaio.intake.dialect_uuid: d3a813ac-f9b5-451c-a602-a5994544d9ed
  event.provider: s3.amazonaws.com
  event.action: PutBucketReplication
condition: selection

Field Validations

Loading…

Comments (0)

Loading comments...