Analytics BIOC
Informational
✕
An AWS S3 bucket configuration was modified
An AWS S3 bucket configuration has been modified.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Defense Evasion (TA0005) Impact (TA0040)
ATT&CK techniques: Impair Defenses (T1562) Data Encrypted for Impact (T1486)
Detector tags: Cloud Data Asset Configuration Data Detection & Response
Attacker's goals:
Modify storage configuration to detection or allow access to sensitive information.
Investigative actions:
Examine AWS S3 access to identify any suspicious activity.* Check which S3 buckets were affected.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days