AWS S3 Credential File Retrieved from Bucket

  1[metadata]
  2creation_date = "2026/05/27"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7
  8[rule]
  9author = ["Elastic"]
 10description = """
 11Detects successful S3 GetObject calls targeting high-value credential and secret files commonly
 12stored in S3 buckets: AWS credentials files (".aws/credentials", ".aws/config"), SSH private keys
 13("id_rsa", "id_ed25519", "id_ecdsa", "id_dsa"), environment files (".env"), PEM and PuTTY key files,
 14and other private key patterns. These file types are high-yield targets for credential harvesting
 15from S3. The rule excludes AWSService identity type to suppress S3 replication, Glacier restore,
 16and other AWS-internal data movement that legitimately reads these files.
 17"""
 18false_positives = [
 19    """
 20    Legitimate CI/CD pipelines, infrastructure tooling, or configuration management systems may retrieve
 21    secret files from S3 as part of their normal operation. Validate the calling identity, user agent,
 22    and source IP against known automation accounts and expected access patterns.
 23    """,
 24]
 25from = "now-6m"
 26index = ["filebeat-*", "logs-aws.cloudtrail-*"]
 27language = "kuery"
 28license = "Elastic License v2"
 29name = "AWS S3 Credential File Retrieved from Bucket"
 30note = """## Triage and analysis
 31
 32### Investigating AWS S3 Credential File Retrieved from Bucket
 33
 34S3 is frequently used to store configuration files, scripts, and secrets. When files with credential-like
 35names are accessed, it warrants investigation to ensure that the retrieval was authorized.
 36
 37### Possible investigation steps
 38
 39- **Identify the accessed file**: Review `aws.cloudtrail.request_parameters` for the bucket name and key.
 40  Determine whether the bucket is intended to store secrets.
 41- **Verify the caller**: Inspect `aws.cloudtrail.user_identity.arn` and `source.ip`. If the caller is not
 42  an approved automation role, escalate immediately.
 43- **Check bucket permissions**: Determine if the bucket is publicly accessible or if the key naming
 44  pattern was intentionally exposed.
 45- **Look for downstream actions**: Search for subsequent IAM, STS, or console actions from the same
 46  identity shortly after the object retrieval, which may indicate successful credential use.
 47
 48### False positive analysis
 49
 50- Legitimate backup or restore processes may access credential files stored in S3 as part of their
 51  workflow. Validate the calling identity and user agent against known automation accounts.
 52- CI/CD pipelines that retrieve secrets from S3 during deployment may trigger this rule. Verify the
 53  source IP and ARN match expected automation infrastructure.
 54
 55### Response and remediation
 56
 57- Immediately disable the access key identified in `aws.cloudtrail.user_identity.access_key_id` if
 58  the retrieval is determined to be unauthorized.
 59- Audit the S3 bucket for overly permissive policies or public access configurations.
 60- Rotate any credentials stored in the accessed object — treat them as compromised.
 61- Review all CloudTrail events from the same identity in the preceding 30 minutes for signs of
 62  lateral movement, IAM changes, or resource creation.
 63- Implement S3 bucket policies or IAM conditions restricting access to credential files to only
 64  authorized identities and source IPs.
 65"""
 66references = [
 67    "https://docs.aws.amazon.com/AmazonS3/latest/API/API_GetObject.html",
 68]
 69risk_score = 47
 70rule_id = "2f0ee9fe-4529-4b9e-9f78-6c81ef33c6ba"
 71severity = "medium"
 72setup = """S3 data event logging is required for this rule. This rule detects S3 GetObject events,
 73which are data plane events not logged by default. To enable: CloudTrail console → Trails →
 74[trail name] → Data events → Add S3 → select the buckets to monitor (or all buckets with a wildcard).
 75Without this configuration, the rule produces no alerts.
 76
 77Refer to the AWS documentation on
 78https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html[logging data events]
 79for detailed steps.
 80"""
 81tags = [
 82    "Domain: Cloud",
 83    "Data Source: AWS",
 84    "Data Source: Amazon Web Services",
 85    "Platform: AWS",
 86    "Data Source: AWS CloudTrail",
 87    "Service: AWS S3",
 88    "Tactic: Credential Access",
 89    "Tactic: Collection",
 90    "Rule Type: Custom Query (KQL)",
 91    "Resources: Investigation Guide",
 92    "Noise: Medium",
 93    "Performance: Slow",
 94    "Profile: Aggressive",
 95]
 96timestamp_override = "event.ingested"
 97type = "query"
 98
 99query = '''
100data_stream.dataset: "aws.cloudtrail" and
101    event.provider: "s3.amazonaws.com" and
102    event.action: "GetObject" and
103    event.outcome: "success" and
104    aws.cloudtrail.flattened.request_parameters.key: (
105        */.aws/credentials or
106        */.aws/config or
107        */id_rsa or
108        */id_ed25519 or
109        */id_ecdsa or
110        */id_dsa or
111        */.env or
112        */.env.* or
113        *.ppk or
114        *.pem or
115        *.key or
116        *private_key* or
117        */.ssh/authorized_keys
118    ) and
119    not aws.cloudtrail.user_identity.type: "AWSService" and
120    not user.name: (AWSAccelerator-*) and
121    not aws.cloudtrail.additional_eventdata: *bytesTransferredOut=0*
122'''
123
124[[rule.threat]]
125framework = "MITRE ATT&CK"
126
127[[rule.threat.technique]]
128id = "T1552"
129name = "Unsecured Credentials"
130reference = "https://attack.mitre.org/techniques/T1552/"
131
132[[rule.threat.technique.subtechnique]]
133id = "T1552.001"
134name = "Credentials In Files"
135reference = "https://attack.mitre.org/techniques/T1552/001/"
136
137[rule.threat.tactic]
138id = "TA0006"
139name = "Credential Access"
140reference = "https://attack.mitre.org/tactics/TA0006/"
141
142[[rule.threat]]
143framework = "MITRE ATT&CK"
144
145[[rule.threat.technique]]
146id = "T1530"
147name = "Data from Cloud Storage"
148reference = "https://attack.mitre.org/techniques/T1530/"
149
150[rule.threat.tactic]
151id = "TA0009"
152name = "Collection"
153reference = "https://attack.mitre.org/tactics/TA0009/"
154
155[rule.alert_suppression]
156group_by = ["source.ip", "cloud.account.id"]
157duration = {value = 5, unit = "m"}
158missing_fields_strategy = "suppress"
159
160[rule.investigation_fields]
161field_names = [
162    "@timestamp",
163    "user.name",
164    "user_agent.original",
165    "source.ip",
166    "source.as.number",
167    "aws.cloudtrail.user_identity.arn",
168    "aws.cloudtrail.user_identity.type",
169    "aws.cloudtrail.user_identity.access_key_id",
170    "aws.cloudtrail.flattened.request_parameters.key",
171    "event.action",
172    "event.provider",
173    "event.outcome",
174    "cloud.account.id",
175    "cloud.region",
176    "aws.cloudtrail.request_parameters",
177]