Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS Exfiltration via Batch Service

The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. It leverages AWS CloudTrail logs to detect the `JobCreated` event, analyzing job details and their status. This activity is significant because attackers can exploit this feature to exfiltrate data by creating malicious batch jobs. If confirmed malicious, this could lead to unauthorized data transfer between S3 buckets, resulting in data breaches and loss of sensitive information.

ATT&CK coverage

Outside the enterprise matrix

T1119

Detection requirements

Log source category: aws_cloudtrail_jobcreated

What the source says

What fires this without an attack behind it

It is possible that an AWS Administrator or a user has legitimately created this job for some tasks.

References

Tagged by the source as

Data ExfiltrationAWS AccountcloudSplunk CloudSplunk EnterpriseSplunk Enterprise Securitythreat

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.