Analytics BIOC Informational

Bucket's block public access setting turned off

S3 bucket block public access setting turned off.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response
Attacker's goals:

Expose bucket to the public and maintain access to bucket's resources avoiding detection.

Investigative actions:

Check if {cloud_best_identity_match} intended to modify block public access settings. Check if the {bucket_name} bucket contains any sensitive information.

Test period:
N/A (single event)
Deduplication:
1 Day