Suspicious identity downloaded multiple objects from a bucket

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Collection (TA0009) Exfiltration (TA0010)
ATT&CK Technique	Data from Cloud Storage (T1530) Automated Exfiltration (T1020)
Severity	Low

Description

An identity downloaded multiple objects from a bucket, considerably more than usual.
This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Attacker's Goals

Exfiltrate sensitive data from the cloud environment.

Investigative actions

Check the accessed bucket and objects designation.
Verify that the identity did not download any sensitive information that it shouldn't.

Variations

Suspicious identity downloaded multiple objects from a backup storage bucket

Synopsis

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Description

An identity downloaded multiple objects from a bucket, considerably more than usual.
This may indicate an attacker's attempt to download sensitive data from a bucket in the cloud environment.

Attacker's Goals

Exfiltrate sensitive data from the cloud environment.

Investigative actions

Check the accessed bucket and objects designation.
Verify that the identity did not download any sensitive information that it shouldn't.