Tag
Rapid Enumeration of AWS S3 Buckets
2 rules 4 TTPsAn AWS principal rapidly enumerates S3 bucket posture using read-only APIs, indicative of reconnaissance, scanning, or post-compromise activity.
AWS S3 Rapid Bucket Posture API Calls Indicate Reconnaissance
2 rules 4 TTPsAn AWS principal rapidly enumerates S3 bucket configurations using read-only APIs, potentially indicating reconnaissance activity by security scanners, CSPM tools, or malicious actors performing post-compromise enumeration.
MinIO SSE Metadata Injection via Replication Headers Leads to Data Unreadability
2 rules 1 TTPA vulnerability in MinIO allows authenticated users with `s3:PutObject` permission to inject internal server-side encryption metadata into objects via crafted replication headers, leading to permanent data unreadability.
S3Browser IAM Policy Creation with Default Bucket Name
2 rules 3 TTPsAn AWS IAM policy is created by the S3Browser utility with the default S3 bucket name placeholder, potentially indicating unauthorized access or misconfiguration.
AWS S3 Bucket Deletion Detected via CloudTrail
3 rules 1 TTPAn AWS S3 bucket deletion event was detected via CloudTrail logs, potentially indicating data loss or unauthorized access attempts.