Skip to content

Commit 172e1d5

Browse files
josehelpsjosehelps
committed
first draft
1 parent 3aef81e commit 172e1d5

File tree

4 files changed

+209
-0
lines changed

4 files changed

+209
-0
lines changed

‎baselines/baseline_of_open_s3_bucket_decommissioning.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
data_source: []
2+
mitre_attack_ids: ''
3+
security_domain: audit
4+
name: Baseline Of Open S3 Bucket Decommissioning
5+
id: 984e9022-b87b-499a-a260-8d0282c46ea2
6+
version: 1
7+
date: '2025-02-12'
8+
author: Jose Hernandez
9+
type: Baseline
10+
status: production
11+
description: This baseline search identifies S3 buckets that were previously exposed to the public (either through bucket policies or website hosting) and have been subsequently deleted. This helps track the lifecycle of potentially risky S3 bucket configurations and their proper decommissioning.
12+
kind: cloud
13+
search: '`cloudtrail` eventSource="s3.amazonaws.com" (eventName=DeleteBucket OR eventName=PutBucketPolicy OR eventName=PutBucketWebsite)
14+
| spath input=_raw path=requestParameters.bucketName output=bucketName
15+
| spath input=_raw path=requestParameters.Host output=host
16+
| spath input=_raw path=requestParameters.bucketPolicy.Statement{} output=statements
17+
| spath input=statements output=principal path=Principal
18+
| spath input=statements output=effect path=Effect
19+
| spath input=statements output=action path=Action
20+
| stats values(eventName) as events,
21+
values(requestParameters.bucketPolicy) as policies,
22+
values(principal) as principals,
23+
values(effect) as effects,
24+
values(action) as actions,
25+
min(_time) as firstEvent,
26+
max(_time) as lastEvent,
27+
values(userIdentity.accountId) as accountIds,
28+
values(userIdentity.arn) as userARNs,
29+
values(awsRegion) as awsRegions,
30+
values(host) as hosts
31+
by bucketName
32+
| eval isPublicPolicy = if( (mvfind(principals, "\\*")>=0) AND (mvfind(effects, "Allow")>=0) AND (mvfind(actions, "s3:GetObject")>=0), 1, 0)
33+
| eval isWebsite = if(mvfind(events, "PutBucketWebsite")>=0, 1, 0)
34+
| eval is_open = if(isPublicPolicy==1 OR isWebsite==1, 1, 0)
35+
| where is_open==1 AND (mvfind(events, "DeleteBucket")>=0)
36+
| eval policy_details = if(isPublicPolicy==1, "Policy: Principal=" . mvjoin(principals, ", ") . " Effect=" . mvjoin(effects, ", ") . " Action=" . mvjoin(actions, ", "), "No Public Policy")
37+
| eval website_details = if(isWebsite==1, "Static Website Enabled", "No Website Hosting")
38+
| table bucketName, hosts, firstEvent, lastEvent, events, policy_details, website_details, accountIds, userARNs, awsRegions
39+
| outputlookup append=true decommissioned_buckets.csv | `baseline_of_open_s3_bucket_decommissioning_filter`'
40+
how_to_implement: To implement this baseline, you need to have AWS CloudTrail logs being ingested into Splunk with the AWS Add-on properly configured. The search looks for S3 bucket events related to bucket policies, website hosting configuration, and bucket deletion. The results are stored in a lookup file named decommissioned_buckets.csv which tracks the history of deleted buckets that were previously exposed to the public.
41+
known_false_positives: Some buckets may be intentionally made public for legitimate business purposes before being decommissioned. Review the policy_details and website_details fields to understand the nature of the public access that was configured.
42+
references:
43+
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
44+
- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
45+
- https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
46+
tags:
47+
analytic_story:
48+
- AWS S3 Bucket Security Monitoring
49+
- Suspicious AWS S3 Activities
50+
message: An S3 bucket that was previously configured with public access has been deleted
51+
product:
52+
- Splunk Enterprise
53+
- Splunk Enterprise Security
54+
- Splunk Cloud
55+
detections:
56+
- Detect DNS Query to Decommissioned S3 Bucket
57+
- Detect Web Access to Decommissioned S3 Bucket
58+
security_domain: audit
59+
deployment:
60+
scheduling:
61+
cron_schedule: 0 2 * * 0
62+
earliest_time: -30d@d
63+
latest_time: -1d@d
64+
schedule_window: auto

‎detections/network/detect_dns_query_to_decommissioned_s3_bucket.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Detect DNS Query to Decommissioned S3 Bucket
2+
id: 2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e
3+
version: 1
4+
date: '2025-02-12'
5+
author: Jose Hernandez, Splunk
6+
status: experimental
7+
type: anomaly
8+
description: This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. This activity is significant because attackers may attempt to recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
9+
data_source:
10+
- DNS logs
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Resolution where DNS.message_type=QUERY by DNS.query DNS.src
12+
| `drop_dm_object_name("DNS")`
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| eval bucket_domain = lower(query)
16+
| lookup decommissioned_buckets.csv bucketName as bucket_domain OUTPUT bucketName as match
17+
| where isnotnull(match)
18+
| `detect_dns_query_to_decommissioned_s3_bucket_filter`'
19+
how_to_implement: To successfully implement this detection, you need to be ingesting DNS query logs and have them mapped to the Network_Resolution data model. Additionally, ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is running and populating the decommissioned_buckets.csv lookup file.
20+
known_false_positives: Some applications or scripts may continue to reference old S3 bucket names after they have been decommissioned. These should be investigated and updated to prevent potential security risks.
21+
references:
22+
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
23+
- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
24+
drilldown_searches:
25+
- name: DNS Activity for Host
26+
search: '| from datamodel:Network_Resolution | search src="$src$"'
27+
earliest_offset: -7d@d
28+
latest_offset: now
29+
rba:
30+
message: A DNS query to decommissioned S3 bucket $query$ was detected from host $src$
31+
risk_objects:
32+
- field: src
33+
type: system
34+
score: 30
35+
threat_objects:
36+
- field: query
37+
type: domain
38+
tags:
39+
analytic_story:
40+
- AWS S3 Bucket Security Monitoring
41+
- Data Destruction
42+
asset_type: Network
43+
mitre_attack_id:
44+
- T1485
45+
product:
46+
- Splunk Enterprise
47+
- Splunk Enterprise Security
48+
- Splunk Cloud
49+
security_domain: network
50+
tests:
51+
- name: True Positive Test
52+
attack_data:
53+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/dns_decommissioned_bucket/dns.log
54+
source: dns
55+
sourcetype: dns

‎detections/web/detect_web_access_to_decommissioned_s3_bucket.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Detect Web Access to Decommissioned S3 Bucket
2+
id: 3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f
3+
version: 1
4+
date: '2025-02-12'
5+
author: Jose Hernandez, Splunk
6+
status: experimental
7+
type: anomaly
8+
description: This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. This activity is significant because attackers may attempt to access or recreate deleted S3 buckets that were previously public to hijack them for malicious purposes. If successful, this could allow attackers to host malicious content or exfiltrate data through compromised bucket names that may still be referenced by legitimate applications.
9+
data_source:
10+
- Web proxy logs
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Web.http_method) as http_method values(Web.http_user_agent) as http_user_agent values(Web.url) as url values(Web.user) as user from datamodel=Web where Web.url_domain!="" by Web.src Web.url_domain
12+
| `drop_dm_object_name("Web")`
13+
| `security_content_ctime(firstTime)`
14+
| `security_content_ctime(lastTime)`
15+
| eval bucket_domain = lower(url_domain)
16+
| lookup decommissioned_buckets.csv bucketName as bucket_domain OUTPUT bucketName as match
17+
| where isnotnull(match)
18+
| `detect_web_access_to_decommissioned_s3_bucket_filter`'
19+
how_to_implement: To successfully implement this detection, you need to be ingesting web proxy logs and have them mapped to the Web data model. Additionally, ensure that the baseline search "Baseline Of Open S3 Bucket Decommissioning" is running and populating the decommissioned_buckets.csv lookup file.
20+
known_false_positives: Some applications or web pages may continue to reference old S3 bucket URLs after they have been decommissioned. These should be investigated and updated to prevent potential security risks.
21+
references:
22+
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
23+
- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
24+
drilldown_searches:
25+
- name: Web Activity for Host and User
26+
search: '| from datamodel:Web | search src="$src$" user="$user$"'
27+
earliest_offset: -7d@d
28+
latest_offset: now
29+
- name: Investigate traffic to domain
30+
search: '| from datamodel:Web | search src="$src$" url_domain="$url_domain$"'
31+
earliest_offset: -7d@d
32+
latest_offset: now
33+
rba:
34+
message: A web request to decommissioned S3 bucket domain $url_domain$ was detected from host $src$ by user $user$
35+
risk_objects:
36+
- field: src
37+
type: system
38+
score: 30
39+
threat_objects:
40+
- field: url_domain
41+
type: domain
42+
tags:
43+
analytic_story:
44+
- AWS S3 Bucket Security Monitoring
45+
- Data Destruction
46+
asset_type: Web
47+
mitre_attack_id:
48+
- T1485
49+
product:
50+
- Splunk Enterprise
51+
- Splunk Enterprise Security
52+
- Splunk Cloud
53+
security_domain: network
54+
tests:
55+
- name: True Positive Test
56+
attack_data:
57+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/web_decommissioned_bucket/proxy.log
58+
source: proxy
59+
sourcetype: web_proxy

‎stories/aws_s3_bucket_security_monitoring.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: AWS S3 Bucket Security Monitoring
2+
id: 8d74f258-d69e-4e4f-b7b3-57c0bdc772b5
3+
version: 1
4+
date: '2025-02-12'
5+
author: Jose Hernandez, Splunk
6+
status: production
7+
description: This analytic story contains detections that monitor AWS S3 bucket configurations, access patterns, and potential security risks, with a specific focus on tracking decommissioned public buckets to prevent bucket hijacking attempts.
8+
narrative: 'Amazon Simple Storage Service (S3) is a widely used object storage service that allows organizations to store and retrieve any amount of data. While S3 buckets are private by default, they can be configured for public access through bucket policies or static website hosting. This flexibility, while useful for legitimate purposes, can also lead to security risks if not properly managed.
9+
10+
A particularly concerning attack vector is the hijacking of decommissioned S3 buckets. When a public S3 bucket is deleted, its unique name becomes available for anyone to claim. Attackers can monitor for deleted buckets that were previously public and attempt to recreate them, potentially intercepting data from applications that still reference these buckets or using them to host malicious content.
11+
12+
This analytic story focuses on:
13+
1. Tracking S3 buckets that were public (via policy or website hosting) before deletion
14+
2. Detecting attempts to access or query these decommissioned bucket names
15+
3. Identifying potential bucket hijacking attempts
16+
4. Helping organizations maintain proper S3 bucket hygiene and prevent security incidents related to bucket name reuse
17+
18+
The detections in this story leverage AWS CloudTrail logs, DNS queries, and web proxy data to provide comprehensive monitoring of S3 bucket lifecycle and access patterns.'
19+
references:
20+
- https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html
21+
- https://labs.watchtowr.com/8-million-requests-later-we-made-the-solarwinds-supply-chain-attack-look-amateur/
22+
- https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/
23+
tags:
24+
category:
25+
- Cloud Security
26+
product:
27+
- Splunk Security Analytics for AWS
28+
- Splunk Enterprise
29+
- Splunk Enterprise Security
30+
- Splunk Cloud
31+
usecase: Security Monitoring

0 commit comments

Comments
 (0)