Analytics BIOC
Informational
✕
Bucket's object ownership controls were modified
S3 bucket object ownership controls were modified.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Exfiltration (TA0010)
ATT&CK techniques: Transfer Data to Cloud Account (T1537)
Detector tags: Data Detection & Response
Attacker's goals:
Maintain control and access to data that resides inside the S3 bucket.
Investigative actions:
Check if {cloud_best_identity_match} intended to modify bucket's object ownership. Check if the {aws_s3bucket_identifier} bucket contains any sensitive information.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day