Bucket's block public access setting turned off

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2026-01-14
Category
Analytics Alert Reference
Index by
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • AWS Audit Log

Detection Modules

Cloud

Detector Tags

Data Detection & Response

ATT&CK Tactic

Exfiltration (TA0010)

ATT&CK Technique

Transfer Data to Cloud Account (T1537)

Severity

Informational

Description

S3 bucket block public access setting turned off.

Attacker's Goals

Expose bucket to the public and maintain access to bucket's resources avoiding detection.

Investigative actions

  • Check if {cloud_best_identity_match} intended to modify block public access settings.
  • Check if the {aws_s3bucket_identifier} bucket contains any sensitive information.