AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder
Detects S3 Browser–initiated IAM PutUserPolicy requests that include a templated S3 bucket placeholder in the inline policy.
- Product
- aws
- Service
- cloudtrail
- Author
- daniel.bohannon@permiso.io (@danielhbohannon) (SigmaHQ), DRL 1.1
- Published
- 2023-05-17
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies CloudTrail IAM PutUserPolicy events where the user agent contains "S3 Browser" and the request includes an inline policy referencing the default S3 bucket placeholder ARN value. Attackers can use templated or copy-pasted policies to quickly grant S3 permissions for persistence or access after gaining a foothold. The detection relies on CloudTrail IAM events, matching eventName=PutUserPolicy and specific requestParameters content indicative of the placeholder bucket and S3 GetObject allow statement.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder"
id: 850a45a6-2c78-4d4d-9c91-faf0cbd389e0
status: test
description: This rule identifies CloudTrail IAM PutUserPolicy events where the user agent contains "S3 Browser" and the request includes an inline policy referencing the default S3 bucket placeholder ARN value. Attackers can use templated or copy-pasted policies to quickly grant S3 permissions for persistence or access after gaining a foothold. The detection relies on CloudTrail IAM events, matching eventName=PutUserPolicy and specific requestParameters content indicative of the placeholder bucket and S3 GetObject allow statement.
references:
- https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml
author: daniel.bohannon@permiso.io (@danielhbohannon), Huntrule Team
date: 2023-05-17
tags:
- attack.execution
- attack.stealth
- attack.t1059.009
- attack.persistence
- attack.initial-access
- attack.privilege-escalation
- attack.t1078.004
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: iam.amazonaws.com
eventName: PutUserPolicy
userAgent|contains: S3 Browser
requestParameters|contains|all:
- '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"'
- '"s3:GetObject"'
- '"Allow"'
condition: selection
falsepositives:
- Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value
level: high
license: DRL-1.1
related:
- id: db014773-7375-4f4e-b83b-133337c0ffee
type: derived