Convert indexed Sigma rules into analyst-ready detections.
This studio is built around Phoenix's own rule corpus, not a blank editor. Search by title or rule id, choose a local pySigma backend, then reveal pipelines only when you actually need them.
Indexed Rules
3,779
Ready to search
Backends
3
Loaded from pysigma-node
pySigma Versions
2
Newest: 2.0.1
Translation Workspace
Shape the rule before it leaves Phoenix
Tune Translation
Active Rule
AWS Bucket Block Public Access Weakened
Backends follow their supported pySigma version. Select 1.5.1 for Elasticsearch, Kusto, and other 1.x plugins.
Target Profile
Splunk
Splunk through pysigma-backend-splunk.
Format Mode
Default
Default pySigma output mode for this backend.
AWS Bucket Block Public Access Weakened
Using Splunk · Default · pySigma 2.0.1
Translation controls
Adjust the rule on the left, then regenerate when you want a fresh backend-native query.
title: AWS Bucket Block Public Access Weakened
id: ab18a523-e093-4ac6-8303-8c47431f4fca
status: experimental
description: |
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
references:
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
- https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
author: Shoban Chiddarth
date: 2026-10-21
tags:
- attack.defense-impairment
- attack.t1686.001
logsource:
product: aws
service: cloudtrail
detection:
selection_event_name:
eventSource: 's3.amazonaws.com'
eventName: 'PutBucketPublicAccessBlock'
selection_weaken_restrict_public_buckets:
requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: 'false'
selection_weaken_block_public_acls:
requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: 'false'
selection_weaken_block_public_policy:
requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: 'false'
selection_weaken_ignore_public_acls:
requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: 'false'
selection_status_success:
errorCode: 'Success'
selection_status_null:
errorCode: null
condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
falsepositives:
- Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.
level: medium
CLI command
Sigma CLI 4.0.0 · Install matching versions, then run from the Phoenix project directory.
python -m pip install 'sigma-cli==4.0.0' 'pysigma==2.0.1' 'pysigma-backend-splunk==3.0.0'
sigma convert --without-pipeline -t splunk -f default 'sigma/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_block_public_access_weakened.yml'