<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: investigating-s3-bucket-breaches
description: >-
  Investigate S3 bucket incidents including unauthorized access, exfiltration, and policy misconfiguration.
domain: cybersecurity
subdomain: cloud-forensics
tags:
  - aws
  - s3
  - data-breach
  - forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1530"]
---

# Investigating S3 Bucket Breaches

## Overview

Investigate S3 bucket incidents including unauthorized access, exfiltration, and policy misconfiguration.

## Prerequisites

| Requirement | Install |
|---|---|
| AWS CLI | S3 access |
| S3 access logs | Enabled |
| Python 3.10+ | For agent tooling |

## Key Concepts

S3 breach investigation covers access log analysis, bucket policy
review, public access assessment, and exfiltration timeline.

## Quick Reference

```bash
aws s3api get-bucket-policy --bucket target-bucket
node agent.js analyze --bucket target-bucket --check policy,acl,encryption
node agent.js access-logs --bucket target-bucket --days 30
node agent.js report --investigation S3-2026-001
```

## Workflow

1. Assess config
2. Review policy/ACLs
3. Analyze access logs
4. Identify unauthorized access
5. Quantify exfiltration
6. Check encryption
7. Document remediation

## Detection

```yaml
title: Investigating S3 Bucket Breaches Detection
id: 12f8f993-631c-41fe-8610-55ab9233806c
status: experimental
description: Detects suspicious activity related to investigating s3 bucket breaches techniques in cloud forensics context
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: high
tags:
  - attack.t1530
  - attack.collection
falsepositives:
  - Scheduled compliance scanning by authorized security tools
```

## Verification

- Verify policy analysis
- Confirm log parsing
- Validate access detection
- Check exfiltration quantified
- Verify remediation

## References

- OWASP Testing Guide — https://owasp.org/www-project-web-security-testing-guide/
- MITRE ATT&CK — https://attack.mitre.org/
- NIST SP 800-53 — https://csf.tools/reference/nist-sp-800-53/
