Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - S3 bucket access point publicly exposed

Detects S3 access point policy changes that allow public principals. Public exposure through access point configuration can lead to unauthorized data access and potential information disclosure.

ATT&CK coverage

Exfiltration

T1537Transfer Data to Cloud Account 41 detections cover this technique

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

Exfiltration

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.