AWSCloudTrail - S3 Object Exfiltration from Anonymous User

Back


Id	15d3bf4e-8708-41c8-a836-8b0aa5be730e
Rulename	AWSCloudTrail - S3 Object Exfiltration from Anonymous User
Description	Detects S3 GetObject activity performed by anonymous principals, which can indicate unauthorized object access and potential data exfiltration from public or misconfigured buckets.
Severity	Medium
Tactics	Collection
Techniques	T1530
Required data connectors	AWS
Kind	Scheduled
Query frequency	5m
Query period	5m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_S3ObjectExfiltrationByAnonymousUser.yaml
Version	1.0.1
Arm template	15d3bf4e-8708-41c8-a836-8b0aa5be730e.json

KQL

AWSCloudTrail
| where ((UserIdentityAccountId =~ @'ANONYMOUS_PRINCIPAL' or UserIdentityPrincipalid == "Anonymous") and EventName == 'GetObject')
| extend
   BucketName = parse_json(RequestParameters).bucketName,
   ObjectKey = parse_json(RequestParameters).key
| extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
| extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]

YAML

entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: Name
    columnName: Name
  - identifier: UPNSuffix
    columnName: UpnSuffix
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: SourceIpAddress
tactics:
- Collection
requiredDataConnectors:
- dataTypes:
  - AWSCloudTrail
  connectorId: AWS
alertDetailsOverride:
  alertDisplayNameFormat: AWS S3 object access by anonymous principal in bucket {{BucketName}}
  alertDescriptionFormat: Detected anonymous GetObject activity for bucket {{BucketName}} and object {{ObjectKey}} from {{SourceIpAddress}}.
id: 15d3bf4e-8708-41c8-a836-8b0aa5be730e
severity: Medium
status: Available
customDetails:
  ObjectKey: ObjectKey
  BucketName: BucketName
query: |
  AWSCloudTrail
  | where ((UserIdentityAccountId =~ @'ANONYMOUS_PRINCIPAL' or UserIdentityPrincipalid == "Anonymous") and EventName == 'GetObject')
  | extend
     BucketName = parse_json(RequestParameters).bucketName,
     ObjectKey = parse_json(RequestParameters).key
  | extend UserName = substring(UserIdentityPrincipalid, indexof_regex(UserIdentityPrincipalid, ":") + 1)
  | extend Name = split(UserName,'@')[0],UpnSuffix = split(UserName,'@')[1]  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon Web Services/Analytic Rules/AWS_S3ObjectExfiltrationByAnonymousUser.yaml
kind: Scheduled
queryPeriod: 5m
version: 1.0.1
name: AWSCloudTrail - S3 Object Exfiltration from Anonymous User
queryFrequency: 5m
triggerThreshold: 0
relevantTechniques:
- T1530
description: |
  Detects S3 GetObject activity performed by anonymous principals, which can indicate unauthorized object access
  and potential data exfiltration from public or misconfigured buckets.  
triggerOperator: gt

ARM