Potential Bucket Enumeration on AWS

Title: Potential Bucket Enumeration on AWS
Status: test
Description:Looks for potential enumeration of AWS buckets via ListBuckets.
References:
  -https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
  -https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
  -https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2023-01-06
modified:2024-07-10
Tags:

• -'attack.discovery'
• -'attack.t1580'
• -'attack.t1619'

Logsource:

• product: aws
• service: cloudtrail

Detection:
  selection:
    eventSource: 's3.amazonaws.com'
    eventName: 'ListBuckets'
  filter:
    userIdentity.type: 'AssumedRole'
  condition:selection and not filter
Falsepositives:
  -Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
Level: low