Bucket's object ownership controls were modified

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

Description

S3 bucket object ownership controls were modified.

Attacker's Goals

Maintain control and access to data that resides inside the S3 bucket.

Investigative actions

• Check if {cloud_best_identity_match} intended to modify bucket's object ownership.
• Check if the {aws_s3bucket_identifier} bucket contains any sensitive information.