Bucket's object ownership controls were modified

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2026-01-14
Category
Analytics Alert Reference
Index by
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

N/A (single event)

Deduplication Period

1 Day

Required Data

  • Requires:
    • AWS Audit Log

Detection Modules

Cloud

Detector Tags

Data Detection & Response

ATT&CK Tactic

Exfiltration (TA0010)

ATT&CK Technique

Transfer Data to Cloud Account (T1537)

Severity

Informational

Description

S3 bucket object ownership controls were modified.

Attacker's Goals

Maintain control and access to data that resides inside the S3 bucket.

Investigative actions

  • Check if {cloud_best_identity_match} intended to modify bucket's object ownership.
  • Check if the {aws_s3bucket_identifier} bucket contains any sensitive information.