Detectionmediumexperimental

AWS Bucket Block Public Access Weakened

Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Shoban ChiddarthCreated Wed Oct 21ab18a523-e093-4ac6-8303-8c47431f4fcacloud

Log Source

AWScloudtrail

ProductAWS← raw: aws

Servicecloudtrail← raw: cloudtrail

Detection Logic

detection:
    selection_event_name:
        eventSource: 's3.amazonaws.com'
        eventName: 'PutBucketPublicAccessBlock'
    selection_weaken_restrict_public_buckets:
        requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: 'false'
    selection_weaken_block_public_acls:
        requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: 'false'
    selection_weaken_block_public_policy:
        requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: 'false'
    selection_weaken_ignore_public_acls:
        requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: 'false'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*