Analytics BIOC
Informational
✕
Bucket's block public access setting turned off
S3 bucket block public access setting turned off.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response
Attacker's goals:
Expose bucket to the public and maintain access to bucket's resources avoiding detection.
Investigative actions:
Check if {cloud_best_identity_match} intended to modify block public access settings. Check if the {bucket_name} bucket contains any sensitive information.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day