Possible Bucket Enumeration on AWS (via cloudtrail)

title: Possible Bucket Enumeration on AWS (via cloudtrail)
id: 37feb766-856c-53c3-a2b8-985ce333f7ab
status: stable
description: This rule detects potential enumeration of AWS buckets via ListBuckets.
references:
    - https://attack.mitre.org/techniques/T1619/
    - https://attack.mitre.org/techniques/T1580/
    - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
    - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
    - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
author: Huntrule Team
date: 2026-03-05
tags:
    - attack.discovery
    - attack.t1580
    - attack.t1619
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 's3.amazonaws.com'
        eventName: 'ListBuckets'
    filter:
        userIdentity.type: 'AssumedRole'
    condition: selection and not filter
falsepositives:
    - Unknown
level: low