AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole
Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.
- Product
- aws
- Service
- cloudtrail
- Author
- Christopher Peacock @securepeacock, SCYTHE @scythe_io (SigmaHQ), DRL 1.1
- Published
- 2023-01-06
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags CloudTrail events where an AWS principal calls S3 ListBuckets, indicating possible attempts to enumerate buckets. Attackers may use this information to identify accessible bucket names and further target specific storage resources. It relies on CloudTrail telemetry for eventSource s3.amazonaws.com and eventName ListBuckets, and excludes activity originating from AssumedRole identities.
Reporting behind it
- github.comhttps://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
- jamesonhacking.blogspot.comhttps://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
- securitycafe.rohttps://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AWS CloudTrail: Potential S3 Bucket Enumeration via ListBuckets by Non-AssumedRole"
id: 3d361c33-a922-4841-b7b5-f232a9a0579b
related:
- id: 4723218f-2048-41f6-bcb0-417f2d784f61
type: similar
- id: f305fd62-beca-47da-ad95-7690a0620084
type: derived
status: test
description: This rule flags CloudTrail events where an AWS principal calls S3 ListBuckets, indicating possible attempts to enumerate buckets. Attackers may use this information to identify accessible bucket names and further target specific storage resources. It relies on CloudTrail telemetry for eventSource s3.amazonaws.com and eventName ListBuckets, and excludes activity originating from AssumedRole identities.
references:
- https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
- https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
- https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-01-06
modified: 2024-07-10
tags:
- attack.discovery
- attack.t1580
- attack.t1619
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: s3.amazonaws.com
eventName: ListBuckets
filter:
userIdentity.type: AssumedRole
condition: selection and not filter
falsepositives:
- Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
level: low
license: DRL-1.1