AnalysisType: rule
Filename: aws_s3_bucket_policy_modified.py
RuleID: "AWS.S3.BucketPolicyModified"
DisplayName: "AWS S3 Bucket Policy Modified"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Identity & Access Management
- Exfiltration:Exfiltration Over Web Service
Reports:
CIS:
- 3.8
MITRE ATT&CK:
- TA0010:T1567
Stratus Red Team:
- aws.defense-evasion.cloudtrail-lifecycle-rule
- aws.exfiltration.s3-backdoor-bucket-policy
Severity: Info
DedupPeriodMinutes: 720 # 12 hours
Description: >
An S3 Bucket was modified.
Runbook: https://docs.runpanther.io/alert-runbooks/built-in-rules/aws-s3-bucket-policy-modified
Reference: https://docs.aws.amazon.com/AmazonS3/latest/dev/using-iam-policies.html
SummaryAttributes:
- eventName
- userAgent
- sourceIpAddress
- p_any_aws_arns
Tests:
- Name: S3 Bucket Policy Modified
ExpectedResult: true
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "s3.amazonaws.com",
"eventName": "PutBucketAcl",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla",
"requestParameters":
{
"host": ["bucket.s3.us-west-2.amazonaws.com"],
"bucketName": "bucket",
"acl": [""],
"x-amz-acl": ["private"],
},
"responseElements": null,
"additionalEventData":
{
"SignatureVersion": "SigV4",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"AuthenticationMethod": "AuthHeader",
},
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
- Name: S3 Bucket Policy Modified Error Response
ExpectedResult: false
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "true",
"creationDate": "2019-01-01T00:00:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "s3.amazonaws.com",
"errorCode": "AccessDenied",
"eventName": "PutBucketAcl",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla",
"requestParameters":
{
"host": ["bucket.s3.us-west-2.amazonaws.com"],
"bucketName": "bucket",
"acl": [""],
"x-amz-acl": ["private"],
},
"responseElements": null,
"additionalEventData":
{
"SignatureVersion": "SigV4",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"AuthenticationMethod": "AuthHeader",
},
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
- Name: S3 Bucket Policy Not Modified
ExpectedResult: false
Log:
{
"eventVersion": "1.05",
"userIdentity":
{
"type": "AssumedRole",
"principalId": "1111:tester",
"arn": "arn:aws:sts::123456789012:assumed-role/tester",
"accountId": "123456789012",
"accessKeyId": "1",
"sessionContext":
{
"attributes":
{
"mfaAuthenticated": "false",
"creationDate": "2019-01-01T00:00:00Z",
},
"sessionIssuer":
{
"type": "Role",
"principalId": "1111",
"arn": "arn:aws:iam::123456789012:role/tester",
"accountId": "123456789012",
"userName": "tester",
},
},
},
"eventTime": "2019-01-01T00:00:00Z",
"eventSource": "s3.amazonaws.com",
"eventName": "GetBucketPolicy",
"awsRegion": "us-west-2",
"sourceIPAddress": "111.111.111.111",
"userAgent": "Mozilla",
"requestParameters":
{
"host": ["bucket.s3.us-west-2.amazonaws.com"],
"bucketName": "bucket",
"policy": [""],
},
"responseElements": null,
"additionalEventData":
{
"SignatureVersion": "SigV4",
"CipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
"AuthenticationMethod": "AuthHeader",
},
"requestID": "1",
"eventID": "1",
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
}
# ------ paired body: aws_s3_bucket_policy_modified.py ------
from panther_aws_helpers import aws_cloudtrail_success, aws_rule_context
# API calls that are indicative of KMS CMK Deletion
S3_POLICY_CHANGE_EVENTS = {
"PutBucketAcl",
"PutBucketPolicy",
"PutBucketCors",
"PutBucketLifecycle",
"PutBucketReplication",
"DeleteBucketPolicy",
"DeleteBucketCors",
"DeleteBucketLifecycle",
"DeleteBucketReplication",
}
def rule(event):
return event.get("eventName") in S3_POLICY_CHANGE_EVENTS and aws_cloudtrail_success(event)
def title(event):
return f"S3 bucket modified by [{event.deep_get('userIdentity', 'arn')}]"
def alert_context(event):
return aws_rule_context(event)