Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
1 Hour |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
Cloud |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Informational |
Description
Enumeration of S3 buckets, suggesting potential cloud storage reconnaissance.
Attacker's Goals
- Discover available S3 buckets in the environment.
- Enumerate objects within buckets to determine the type and structure of stored data.
- Evaluate public access configurations of buckets to identify potential exposure or misconfigurations.
Investigative actions
- Identify the identity performing the calls and determine if this behavior aligns with their typical access patterns.
- Check access control policies and public access settings on the enumerated buckets for misconfigurations or unauthorized access attempts.