AWSCloudTrail - Failed Brute Force on S3 Bucket

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Identifies repeated failed S3 GetObject attempts from anonymous or mismatched identities, which may indicate brute force activity against bucket objects.

Attribute	Value
Type	Hunting Query
Solution	Amazon Web Services
ID	13afb771-5d55-4d69-a745-83d2fc69a923
Severity	Medium
Tactics	Discovery
Techniques	T1619
Required Connectors	AWS
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
AWSCloudTrail	EventName == "GetObject" UserIdentityAccountId == "ANONYMOUS_PRINCIPAL"	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Hunting Queries · Back to Amazon Web Services