name: Detect New Open S3 buckets
id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
version: 2
date: '2021-01-12'
author: Bhavin Patel, Patrick Bareiss, Splunk
type: batch
datamodel: []
description: This search looks for CloudTrail events where a user has created an open/public
  S3 bucket.
search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
  "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
  | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
  | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
  | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
  rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
  max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission
  bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `detect_new_open_s3_buckets_filter` '
how_to_implement: You must install the AWS App for Splunk.
known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin has legitimately created a public bucket for a specific purpose.
  That said, AWS strongly advises against granting full control to the "All Users"
  group.
references: []
tags:
  analytic_story:
  - Suspicious AWS S3 Activities
  asset_type: S3 Bucket
  automated_detection_testing: passed
  cis20:
  - CIS 13
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json
  kill_chain_phases:
  - Actions on Objectives
  mitre_attack_id:
  - T1530
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventSource
  - eventName
  - requestParameters.bucketName
  - userName
  - userIdentity.principalId
  - userAgent
  - uri
  - permission
  risk_object: src
  risk_object_type: system
  risk_score: 20
  security_domain: network
