AWSCloudTrail
| where ((UserIdentityAccountId =~ @'ANONYMOUS_PRINCIPAL' or UserIdentityPrincipalid == "Anonymous") and EventName == 'GetObject')
| extend
BucketName = parse_json(RequestParameters).bucketName,
ObjectKey = parse_json(RequestParameters).key
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
id: 15d3bf4e-8708-41c8-a836-8b0aa5be730e
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_S3ObjectExfiltrationByAnonymousUser.yaml
entityMappings:
- fieldMappings:
- identifier: Name
columnName: Name
- identifier: UPNSuffix
columnName: UpnSuffix
entityType: Account
- fieldMappings:
- identifier: Address
columnName: SourceIpAddress
entityType: IP
requiredDataConnectors:
- dataTypes:
- AWSCloudTrail
connectorId: AWS
queryFrequency: 5m
queryPeriod: 5m
status: Available
query: |
AWSCloudTrail
| where ((UserIdentityAccountId =~ @'ANONYMOUS_PRINCIPAL' or UserIdentityPrincipalid == "Anonymous") and EventName == 'GetObject')
| extend
BucketName = parse_json(RequestParameters).bucketName,
ObjectKey = parse_json(RequestParameters).key
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]
name: S3 Object Exfiltration from Anonymous User
kind: Scheduled
tactics:
- Collection
severity: Medium
relevantTechniques:
- T1530
triggerThreshold: 0
version: 1.0.0
description: |
'Identify attempted exfiltration of S3 Bucket objects by an anonymous User'
