AWS CloudTrail S3 ListBuckets by Non-AssumedRole Accounts (Possible Bucket Enumeration)

Identifies S3 ListBuckets calls in CloudTrail that are not from assumed-role identities, which may indicate bucket discovery activity.

FreeUnreviewedSigmalowv1

aws-cloudtrail-s3-listbuckets-by-non-assumedrole-accounts-possible-bucket-enumer-f305fd62

title: AWS CloudTrail S3 ListBuckets by Non-AssumedRole Accounts (Possible Bucket Enumeration)
id: 3d361c33-a922-4841-b7b5-f232a9a0579b
related:
  - id: 4723218f-2048-41f6-bcb0-417f2d784f61
    type: similar
  - id: f305fd62-beca-47da-ad95-7690a0620084
    type: derived
status: test
description: This rule flags AWS CloudTrail events where the S3 API method ListBuckets is called, excluding requests made by assumed-role identities. Attackers may use bucket listing to discover potential targets before attempting further access or enumeration. The detection relies on CloudTrail telemetry for the S3 eventSource and eventName, along with userIdentity.type to filter assumed-role activity.
references:
  - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
  - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
  - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2023-01-06
modified: 2024-07-10
tags:
  - attack.discovery
  - attack.t1580
  - attack.t1619
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: s3.amazonaws.com
    eventName: ListBuckets
  filter:
    userIdentity.type: AssumedRole
  condition: selection and not filter
falsepositives:
  - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
level: low
license: DRL-1.1

What it detects

This rule flags AWS CloudTrail events where the S3 API method ListBuckets is called, excluding requests made by assumed-role identities. Attackers may use bucket listing to discover potential targets before attempting further access or enumeration. The detection relies on CloudTrail telemetry for the S3 eventSource and eventName, along with userIdentity.type to filter assumed-role activity.

Known false positives

Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.