Bucket's block public access setting turned off

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

S3 bucket block public access setting turned off.

Attacker's Goals

Expose bucket to the public and maintain access to bucket's resources avoiding detection.

Investigative actions

• Check if {cloud_best_identity_match} intended to modify block public access settings.
• Check if the {bucket_name} bucket contains any sensitive information.