AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock

ATT&CK techniques

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies successful S3 PutBucketPublicAccessBlock actions where one or more Block Public Access controls are set to false (RestrictPublicBuckets, BlockPublicAcls, BlockPublicPolicy, or IgnorePublicAcls). Weakening these safeguards can enable public exposure if an attacker later changes ACLs or bucket policies. The detection relies on AWS CloudTrail eventName, errorCode, and requestParameters in the PutBucketPublicAccessBlock event.

Reporting behind it

Related detections7 linkedT1686.001 — drag to rearrange

Suspicious Azure Network Security Group Rule Opening Inbound Access to the Internet

Suspicious Security Group Ingress Rule Opened to the Internet via CloudTrail

AWS CloudTrail: CreateRoute Adds New Network Route to a Route Table

AWS CloudTrail: CreateNetworkAclEntry Adds Network ACL Rules

Azure Network Firewall Policy Modified or Deleted via Activity Logs

Azure Firewall Rule Collection Modified or Deleted via Activity Logs

Azure Firewall Created, Modified, or Deleted via Activity Log

AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock

Pivot detection · T1686.001 · 7 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-s3-block-public-access-disabled-via-putbucketpublicaccessblock-ab18a523

title: "AWS CloudTrail: S3 Block Public Access disabled via PutBucketPublicAccessBlock"
id: 00d403e0-69fa-4a76-a1f0-d53f4f3c63c1
status: experimental
description: This rule identifies successful S3 PutBucketPublicAccessBlock actions where one or more Block Public Access controls are set to false (RestrictPublicBuckets, BlockPublicAcls, BlockPublicPolicy, or IgnorePublicAcls). Weakening these safeguards can enable public exposure if an attacker later changes ACLs or bucket policies. The detection relies on AWS CloudTrail eventName, errorCode, and requestParameters in the PutBucketPublicAccessBlock event.
references:
  - https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
  - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutPublicAccessBlock.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_bucket_block_public_access_weakened.yml
author: Shoban Chiddarth, Huntrule Team
date: 2026-10-21
tags:
  - attack.defense-impairment
  - attack.t1686.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event_name:
    eventSource: s3.amazonaws.com
    eventName: PutBucketPublicAccessBlock
  selection_weaken_restrict_public_buckets:
    requestParameters.PublicAccessBlockConfiguration.RestrictPublicBuckets: "false"
  selection_weaken_block_public_acls:
    requestParameters.PublicAccessBlockConfiguration.BlockPublicAcls: "false"
  selection_weaken_block_public_policy:
    requestParameters.PublicAccessBlockConfiguration.BlockPublicPolicy: "false"
  selection_weaken_ignore_public_acls:
    requestParameters.PublicAccessBlockConfiguration.IgnorePublicAcls: "false"
  selection_status_success:
    errorCode: Success
  selection_status_null:
    errorCode: null
  condition: selection_event_name and 1 of selection_weaken_* and 1 of selection_status_*
falsepositives:
  - Administrators intentionally modifying Block Public Access settings to support a legitimate application or public bucket configuration.
level: medium
license: DRL-1.1
related:
  - id: ab18a523-e093-4ac6-8303-8c47431f4fca
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL