AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder

Detects S3 Browser–initiated IAM PutUserPolicy requests that include a templated S3 bucket placeholder in the inline policy.

FreeReviewedSigma · High · v5

Product: aws
Service: cloudtrail
Author: daniel.bohannon@permiso.io (@danielhbohannon) (SigmaHQ), DRL 1.1
Published: 2023-05-17
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1078.004Cloud Accounts
Execution
- T1059.009Cloud API
Persistence
- T1078.004Cloud Accounts
Priv Esc
- T1078.004Cloud Accounts
Defense Evasion
- T1078.004Cloud Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies CloudTrail IAM PutUserPolicy events where the user agent contains "S3 Browser" and the request includes an inline policy referencing the default S3 bucket placeholder ARN value. Attackers can use templated or copy-pasted policies to quickly grant S3 permissions for persistence or access after gaining a foothold. The detection relies on CloudTrail IAM events, matching eventName=PutUserPolicy and specific requestParameters content indicative of the placeholder bucket and S3 GetObject allow statement.

Reporting behind it

Related detections9 linkedT1078.004 — drag to rearrange

AWS CloudTrail: S3 Browser creating IAM LoginProfiles after querying GetLoginProfile

AWS CloudTrail: S3 Browser Creates IAM User or Access Key

Malicious AWS Cross-Account AssumeRole With Suspicious Session Names via CloudTrail (via aws)

Suspicious Okta SSO Access to Many Applications in Short Window

Suspicious Microsoft Entra Device Code Authentication Flow

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

Suspicious AWS Instance Access or Export via SSH Key or Export Task

Suspicious Azure OpenAI Model Enumeration and Deployment Creation (via azure)

Suspicious Azure Cognitive Services Account Key Enumeration via ListKeys (via azure)

AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder

Pivot detection · T1078.004 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-cloudtrail-s3-browser-creates-inline-iam-policy-with-default-bucket-placehol-db014773

title: "AWS CloudTrail: S3 Browser creates inline IAM policy with default bucket placeholder"
id: 850a45a6-2c78-4d4d-9c91-faf0cbd389e0
status: test
description: This rule identifies CloudTrail IAM PutUserPolicy events where the user agent contains "S3 Browser" and the request includes an inline policy referencing the default S3 bucket placeholder ARN value. Attackers can use templated or copy-pasted policies to quickly grant S3 permissions for persistence or access after gaining a foothold. The detection relies on CloudTrail IAM events, matching eventName=PutUserPolicy and specific requestParameters content indicative of the placeholder bucket and S3 GetObject allow statement.
references:
  - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml
author: daniel.bohannon@permiso.io (@danielhbohannon), Huntrule Team
date: 2023-05-17
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.009
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: PutUserPolicy
    userAgent|contains: S3 Browser
    requestParameters|contains|all:
      - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"'
      - '"s3:GetObject"'
      - '"Allow"'
  condition: selection
falsepositives:
  - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value
level: high
license: DRL-1.1
related:
  - id: db014773-7375-4f4e-b83b-133337c0ffee
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL