cscli scenarios install crowdsecurity/aws-cis-benchmark-s3-policy-changeDetects AWS S3 buckets policy changes based on cloudtrail logs (Section 4.8 of CIS AWS Foundation Benchmark 1.4.0 ).
1type: trigger2name: crowdsecurity/aws-cis-benchmark-s3-policy-change3description: "Detect AWS S3 bucket policy change"4filter: |5 evt.Meta.log_type == 'aws-cloudtrail' &&6 evt.Unmarshaled.cloudtrail.eventSource == "s3.amazonaws.com" &&7 (8 evt.Meta.event_name == "PutBucketAcl" ||9 evt.Meta.event_name == "PutBucketPolicy" ||10 evt.Meta.event_name == "PutBucketCors" ||11 evt.Meta.event_name == "PutBucketLifecycle" ||12 evt.Meta.event_name == "PutBucketReplication" ||13 evt.Meta.event_name == "DeleteBucketPolicy" ||14 evt.Meta.event_name == "DeleteBucketCors" ||15 evt.Meta.event_name == "DeleteBucketLifecycle" ||16 evt.Meta.event_name == "DeleteBucketReplication"17 )18labels:19 confidence: 320 spoofable: 021 classification:22 - attack.T157823 behavior: "cloud:audit"24 label: "AWS S3 bucket policy change"25 service: aws26 cti: false27 remediation: false28