Potential Third-Party Cloud Storage Client Execution

  1[metadata]
  2creation_date = "2026/09/14"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/14"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies execution of a third-party S3 or object-storage client (S3 Browser, s5cmd, s3cmd, MinIO mc, rclone,
 11Cyberduck, s3fs, goofys, juicefs) launched by a script interpreter, a shell one-liner, or from a temporary or
 12user-writable path. After stealing cloud credentials, adversaries switch from the AWS CLI to these clients to
 13enumerate and drain buckets in bulk. Gating on a scripted context separates post-exploitation automation from
 14interactive developer use.
 15"""
 16false_positives = [
 17    """
 18    Data engineers and DevOps teams legitimately use rclone, s5cmd, and s3cmd for bulk data transfers. This rule
 19    gates on a scripted parent to suppress interactive use, but automation pipelines that shell out to these tools
 20    may still trigger alerts. The 7-day new-terms window suppresses recurring invocations of the same client on the 
 21    same host after the first alert. Allowlist known pipeline executor paths if additional tuning is needed.
 22    """,
 23]
 24from = "now-9m"
 25index = ["logs-endpoint.events.process*"]
 26language = "kuery"
 27license = "Elastic License v2"
 28name = "Potential Third-Party Cloud Storage Client Execution"
 29
 30note = """## Triage and analysis
 31
 32### Investigating Potential Third-Party Cloud Storage Client Execution
 33
 34This rule fires when a third-party S3 or object-storage client (rclone, s5cmd, s3cmd, MinIO `mc`, S3 Browser, Cyberduck, s3fs, goofys, juicefs, aws-shell) starts under a scripted context: a script interpreter or shell one-liner as parent, or the client or its parent running from a temporary or user-writable path. These tools are common on developer and data-engineering hosts, so the scripted gate is what separates post-exploitation automation from interactive use. After stealing cloud credentials from a compromised server, adversaries drop one of these clients to enumerate, mirror, and then delete bucket contents faster than the AWS CLI allows.
 35
 36### Possible investigation steps
 37
 38- Identify the client and the verb from `process.args`: `cp`, `sync`, `mirror`, `mv`, `rm`, `rb` indicate bulk transfer or deletion; `ls`, `find`, `du` indicate enumeration. Note the source and destination, especially a remote endpoint that is not one of your accounts.
 39- Walk the parent chain. A `sh -c`, `python`, or `node` parent, or a parent in `/tmp`, `/dev/shm`, or `%TEMP%`, is the scripted context the rule keys on. Find what launched that parent (web server worker, cron, CI runner, SSH session, remote management tool).
 40- Determine where the credentials came from. Check for `~/.aws/credentials`, `.env` files, `rclone.conf`, `~/.s3cfg`, `~/.mc/config.json`, environment variables in the parent process, or instance metadata access from the same host shortly before.
 41- Pivot to CloudTrail (or the equivalent provider log) for the principal and the host's egress IP: `ListBuckets`, `ListObjects*`, `GetObject`, `DeleteObject*`, and `PutBucketLifecycle` in volume within the same window confirm data access; `GetCallerIdentity` immediately before is a common first call.
 42- Check the client's user agent in bucket access logs or CloudTrail; S3 Browser, s5cmd, and rclone identify themselves and the `S3 Uncommon Client User Agent` rule may have fired for the same principal.
 43- Correlate with other alerts on the host and principal: credential file access, `Potential Data Exfiltration via Rclone` on Windows, new IAM keys, or bucket policy and versioning changes.
 44
 45### False positive analysis
 46
 47- Backup, replication, and data-pipeline jobs that shell out to `rclone`, `s5cmd`, or `mc` from cron, systemd timers, Airflow, or CI runners. Confirm the job, then add an exception on `process.parent.executable` or the runner path, not on the client name.
 48- Developers running these clients from a script in a checked-out repository. Verify the repository, the destination bucket, and that the credentials used belong to the developer.
 49- Configuration and health-check invocations such as `rclone config`, `rclone listremotes`, or `mc alias set`. These are low risk on their own; exclude by argument if they recur.
 50
 51### Response and remediation
 52
 53- If the activity is not authorized, isolate the host and terminate the client process and its parent.
 54- Rotate or revoke every cloud credential present on the host or referenced in the client's configuration. Treat any key the client used as compromised.
 55- Review the affected buckets for objects downloaded, overwritten, or deleted during the window. Restore from versioning or backups and check for new lifecycle rules, bucket policies, or replication configurations left by the attacker.
 56- Remove the client binary, its configuration files, and any staged data or scripts, and determine the initial access vector (exposed `.env`, RCE on a web application, leaked key).
 57- Escalate to the cloud incident response process if the principal had write or delete permissions on production data, or if objects were transferred to an external account.
 58"""
 59references = [
 60    "https://github.com/ramimac/aws-customer-security-incidents",
 61    "https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/",
 62    "https://blog.darklab.hk/2021/07/06/trouble-in-paradise/",
 63]
 64risk_score = 47
 65rule_id = "ab05c807-e12b-4ec1-8380-844a65c9fef1"
 66setup = """## Setup
 67
 68This rule requires data coming in from Elastic Defend.
 69
 70### Elastic Defend Integration Setup
 71Elastic Defend is integrated into the Elastic Agent using Fleet. Upon configuration, the integration allows the
 72Elastic Agent to monitor events on your host and send data to the Elastic Security app.
 73
 74#### Prerequisite Requirements:
 75- Fleet is required for Elastic Defend.
 76- To configure Fleet Server refer to the [documentation](https://www.elastic.co/guide/en/fleet/current/fleet-server.html).
 77
 78#### The following steps should be executed in order to add the Elastic Defend integration:
 79- Go to the Kibana home page and click "Add integrations".
 80- In the query bar, search for "Elastic Defend" and select the integration to see more details about it.
 81- Click "Add Elastic Defend".
 82- Configure the integration name and optionally add a description.
 83- Select the type of environment you want to protect, either "Traditional Endpoints" or "Cloud Workloads".
 84- Enter a name for the agent policy in "New agent policy name". If other agent policies already exist, you can
 85  click the "Existing hosts" tab and select an existing policy instead.
 86- Click "Save and Continue".
 87- To complete the integration, select "Add Elastic Agent to your hosts" and install Elastic Agent on your hosts.
 88For more details on Elastic Defend refer to the [helper guide](https://www.elastic.co/guide/en/security/current/install-endpoint.html).
 89"""
 90severity = "medium"
 91tags = [
 92    "Domain: Endpoint",
 93    "Domain: Cloud",
 94    "Platform: AWS",
 95    "Platform: Linux",
 96    "Platform: macOS",
 97    "Platform: Windows",
 98    "OS: Linux",
 99    "OS: macOS",
100    "OS: Windows",
101    "Service: AWS S3",
102    "Tactic: Exfiltration",
103    "Tactic: Collection",
104    "Use Case: Threat Detection",
105    "Resources: Investigation Guide",
106    "Data Source: Elastic Defend",
107    "Rule Type: New Terms",
108]
109timestamp_override = "event.ingested"
110type = "new_terms"
111
112query = '''
113event.category : "process" and event.type : "start" and
114process.name : (
115  Cyberduck or S3Browser.exe or aws-shell or cyberduck or duck or duck.exe or
116  goofys or juicefs or mc or mc.exe or rclone or rclone.exe or
117  s3browser-con.exe or s3browser.exe or s3cmd or s3cmd.exe or s3fs or s5cmd or s5cmd.exe or
118  *bucketexplorer* or *cloudberry* or *s3browser*
119) and not (
120  process.name : (mc or mc.exe) and not
121  process.args : (admin or alias or cat or cp or du or find or get or ls or mb or mirror or mv or pipe or put or rb or rm or share or stat or tree)
122) and not process.executable : (/opt/Elastic/Agent/* or /usr/lib/systemd/*) and
123not process.args : (--help or --version or -h or selfupdate or version) and
124(
125  process.parent.name : (
126    bun or bun.exe or cscript.exe or deno or deno.exe or mshta.exe or node or node.exe or nodejs or
127    perl* or php* or python* or ruby* or wscript.exe
128  ) or
129  (
130    process.parent.name : (bash or bash.exe or cmd.exe or dash or fish or ksh or powershell.exe or pwsh or pwsh.exe or sh or zsh) and
131    process.parent.args : ("-Command" or "-EncodedCommand" or "-enc" or "-e" or "-c" or "-ilc" or "-lc" or "/c")
132  ) or
133  process.executable : (
134    *\\Users\\*\\AppData\\Local\\Temp\\* or *\\Users\\Public\\* or *\\Windows\\Temp\\* or
135    /Users/Shared/* or /dev/shm/* or /private/tmp/* or /tmp/* or /var/tmp/*
136  ) or
137  process.parent.executable : (
138    *\\Users\\*\\AppData\\Local\\Temp\\* or *\\Users\\Public\\* or *\\Windows\\Temp\\* or
139    /Users/Shared/* or /dev/shm/* or /private/tmp/* or /tmp/* or /var/tmp/*
140  )
141)
142'''
143
144[[rule.threat]]
145framework = "MITRE ATT&CK"
146
147[[rule.threat.technique]]
148id = "T1537"
149name = "Transfer Data to Cloud Account"
150reference = "https://attack.mitre.org/techniques/T1537/"
151
152[[rule.threat.technique]]
153id = "T1567"
154name = "Exfiltration Over Web Service"
155reference = "https://attack.mitre.org/techniques/T1567/"
156
157[[rule.threat.technique.subtechnique]]
158id = "T1567.002"
159name = "Exfiltration to Cloud Storage"
160reference = "https://attack.mitre.org/techniques/T1567/002/"
161
162[rule.threat.tactic]
163id = "TA0010"
164name = "Exfiltration"
165reference = "https://attack.mitre.org/tactics/TA0010/"
166
167[[rule.threat]]
168framework = "MITRE ATT&CK"
169
170[[rule.threat.technique]]
171id = "T1530"
172name = "Data from Cloud Storage"
173reference = "https://attack.mitre.org/techniques/T1530/"
174
175[rule.threat.tactic]
176id = "TA0009"
177name = "Collection"
178reference = "https://attack.mitre.org/tactics/TA0009/"
179
180[rule.new_terms]
181field = "new_terms_fields"
182value = ["host.id", "process.name"]
183[[rule.new_terms.history_window_start]]
184field = "history_window_start"
185value = "now-7d"