AWS Command Line Interface - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/aws-command-line-interface/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 12:00:00 +0000AWS CLI Activity Detection for Open S3 Bucket Creationhttps://feed.craftedsignal.io/briefs/2024-01-open-s3-buckets/Tue, 09 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-open-s3-buckets/Detection of S3 bucket creation via AWS CLI which might lead to data exposure and unauthorized access.This brief focuses on detecting the creation of publicly accessible Amazon S3 buckets using the AWS Command Line Interface (CLI). While not inherently malicious, creating open S3 buckets can lead to significant data breaches if sensitive information is stored within them. Monitoring AWS CLI usage for S3 bucket creation is crucial for preventing unintentional exposure of data. This activity is often part of a larger attack chain, where adversaries attempt to identify and exploit misconfigured cloud resources for data theft or other malicious purposes. Understanding how these buckets are created and configured allows defenders to identify and remediate potential risks before they are exploited.

Attack Chain

  1. Attacker gains initial access to an AWS account, potentially through compromised credentials or a misconfigured IAM role.
  2. Attacker uses the AWS CLI to interact with the AWS environment.
  3. The attacker utilizes the aws s3api create-bucket command to create a new S3 bucket.
  4. The attacker then uses the aws s3api put-bucket-acl command to set the bucket's Access Control List (ACL) to public-read or public-read-write, making the bucket publicly accessible.
  5. Alternatively, the attacker may use aws s3api put-bucket-policy to configure a bucket policy that allows public access.
  6. The attacker uploads data to the publicly accessible S3 bucket.
  7. The attacker may then attempt to exfiltrate data from other AWS resources into the newly created, open S3 bucket before final exfiltration.
  8. The ultimate goal is to exfiltrate sensitive data or use the open bucket as a staging ground for further attacks.

Impact

The impact of creating open S3 buckets can be severe. Data stored in publicly accessible buckets can be easily accessed by anyone on the internet, leading to data breaches, compliance violations, and reputational damage. Depending on the data stored, this can affect thousands or millions of users. Organizations in all sectors, including healthcare, finance, and government, are potential targets. A successful attack can result in the loss of sensitive personal information, financial data, intellectual property, and other confidential information.

Recommendation

  • Deploy the "Detect New Open S3 Buckets Over AWS CLI" Sigma rule to your SIEM and tune for your environment to detect suspicious bucket creation activity.
  • Monitor AWS CloudTrail logs for CreateBucket and PutBucketAcl events to detect S3 bucket creation and ACL modifications.
  • Implement and enforce least privilege IAM policies to restrict who can create and modify S3 buckets, and limit the ability to make them public.
  • Regularly audit S3 bucket permissions to identify and remediate any publicly accessible buckets.
]]>mediumadvisoryawss3clouddata-breachDetection of Public AWS S3 Bucket Creation via CLIhttps://feed.craftedsignal.io/briefs/2024-01-03-aws-s3-public-bucket/Wed, 03 Jan 2024 10:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-03-aws-s3-public-bucket/An AWS user creates a publicly accessible S3 bucket by using the AWS CLI to set permissive ACLs, potentially leading to unauthorized data access and data breaches.This brief focuses on the detection of publicly accessible Amazon S3 buckets created via the AWS Command Line Interface (CLI). The creation of public S3 buckets is a common security misconfiguration that can lead to sensitive data exposure. This activity is detected by analyzing AWS CloudTrail logs for PutBucketAcl events where the bucket's access control list (ACL) is configured to grant read, write, or full control to "AuthenticatedUsers" or "AllUsers." This activity is particularly important to monitor because it represents a direct path for unauthorized access to data stored within the S3 bucket. The detection logic is based on the Splunk Security Content analytic "Detect New Open S3 Buckets over AWS CLI" (version 9, published April 15, 2026). Successfully exploited public buckets can lead to data exfiltration, data corruption, or other malicious activity.

Attack Chain

  1. An attacker gains access to valid AWS credentials, potentially through compromised user accounts or leaked API keys.
  2. The attacker uses the AWS CLI to create a new S3 bucket using the aws s3api create-bucket command.
  3. The attacker then uses the aws s3api put-bucket-acl command to modify the bucket's Access Control List (ACL).
  4. In the put-bucket-acl command, the attacker sets permissions to grant read, write, or full control to "AuthenticatedUsers" or "AllUsers" by manipulating the x-amz-grant-read, x-amz-grant-write, and x-amz-grant-full-control parameters.
  5. AWS CloudTrail logs the PutBucketAcl event, capturing details of the user, bucket name, and ACL configuration.
  6. The attacker uploads sensitive data to the newly created, publicly accessible S3 bucket.
  7. Unauthorized users or automated bots discover the public S3 bucket and access the exposed data.
  8. The attacker exfiltrates the publicly available data, or modifies/corrupts data within the bucket.

Impact

Creation of publicly accessible S3 buckets can lead to severe data breaches. Unauthorized access to sensitive data stored in these buckets can result in financial loss, reputational damage, and legal liabilities. The number of affected individuals or organizations can vary widely, depending on the type and amount of data exposed. Public buckets can be indexed by search engines, further increasing the risk of unauthorized access. Data exfiltration or corruption can severely disrupt business operations and erode customer trust.

Recommendation

  • Deploy the Sigma rule "Detect Public AWS S3 Bucket Creation via CLI" to your SIEM and tune for your environment to detect the described activity based on CloudTrail logs.
  • Review and harden IAM policies to restrict the ability of users and roles to modify S3 bucket ACLs, preventing unintended public access.
  • Regularly audit existing S3 buckets to identify and remediate any publicly accessible buckets, using AWS Trusted Advisor or similar tools.
  • Implement automated monitoring and alerting for S3 bucket ACL changes using AWS CloudWatch Events and Lambda functions.
  • Enforce the principle of least privilege by granting only necessary permissions to users and roles, minimizing the risk of accidental or malicious misconfiguration.
]]>highadvisoryawss3cloudtrailmisconfigurationdata-breach