Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS S3 Rapid Bucket Posture API Calls from a Single Principal

Identifies when the same AWS principal, from the same source IP, successfully invokes read-only S3 control-plane APIs that reveal bucket posture across many buckets in a short period. This pattern can indicate automated reconnaissance or security scanning, similar to CSPM tools and post-compromise enumeration. The rule excludes AWS service principals, requires programmatic-style sessions (not Management Console credentials), and requires populated resource and identity fields so nulls do not skew cardinality.

ATT&CK coverage

Outside the enterprise matrix

What the source says

What fires this without an attack behind it

Legitimate security scanners, CSPM products, compliance jobs, and inventory automation may call the same read-only bucket APIs across many buckets quickly. Verify the principal ARN, source IP, user agent, and schedule against known approved tooling before treating the activity as malicious.

References

https://kudelskisecurity.com/research/investigating-two-variants-of-the-trivy-supply-chain-compromise

Tagged by the source as

Data Source: Amazon Web ServicesData Source: AWSData Source: AWS CloudTrailData Source: AWS S3Domain: CloudResources: Investigation GuideTactic: CollectionTactic: DiscoveryUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.