AWS S3 Data Management Tampering

calendar Oct 12, 2023 · attack.exfiltration attack.t1537  ·
Share on: linkedin copy

Detects when a user tampers with S3 data management in Amazon Web Services.

Sigma rule (View on GitHub)

 1title: AWS S3 Data Management Tampering
 2id: 78b3756a-7804-4ef7-8555-7b9024a02e2d
 3status: test
 4description: Detects when a user tampers with S3 data management in Amazon Web Services.
 5references:
 6    - https://github.com/elastic/detection-rules/pull/1145/files
 7    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html
 8    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html
 9    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html
10    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html
11    - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html
12    - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html
13author: Austin Songer @austinsonger
14date: 2021/07/24
15modified: 2022/10/09
16tags:
17    - attack.exfiltration
18    - attack.t1537
19logsource:
20    product: aws
21    service: cloudtrail
22detection:
23    selection:
24        eventSource: s3.amazonaws.com
25        eventName:
26            - PutBucketLogging
27            - PutBucketWebsite
28            - PutEncryptionConfiguration
29            - PutLifecycleConfiguration
30            - PutReplicationConfiguration
31            - ReplicateObject
32            - RestoreObject
33    condition: selection
34falsepositives:
35    - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
36level: low

References

Related rules

to-top