Decommissioned Buckets
Description
Dataset generated from AWS CloudTrail logs capturing the lifecycle of an intentionally exposed S3 bucket, including its creation, public access configuration (via bucket policy and website hosting), and subsequent deletion. This simulates the detection of potentially risky S3 bucket configurations and their decommissioning process.
MITRE ATT&CK Techniques
| ID | Technique | Tactic |
|---|---|---|
| T1485 | Data Destruction | Impact |
Environment Details
| Field | Value |
|---|---|
| Environment | attack_range |
| Directory | decommissioned_buckets |
| Test Date | 2025-02-14 |
Datasets
The following datasets were collected during this attack simulation:
Web_cloudfront_access
- Path:
/datasets/attack_techniques/T1485/decommissioned_buckets/web_cloudfront_access.log - Sourcetype:
aws:cloudfront:accesslogs - Source:
aws_cloudfront_accesslogs
Related Detections
The following detections in our security content repository use this attack data for testing:
| Detection Name | Type | Source | MITRE ATT&CK | Analytic Story |
|---|---|---|---|---|
| Detect Web Access to Decommissioned S3 Bucket | Anomaly |
Web | T1485 | AWS S3 Bucket Security Monitoring, Data Destruction |
| Detect DNS Query to Decommissioned S3 Bucket | Anomaly |
Network | T1485 | AWS S3 Bucket Security Monitoring, Data Destruction |
Usage Instructions
Replay with Splunk Attack Data
Replay attack data with replay.py from Splunk Attack Data.
1python replay.py --dataset /datasets/attack_techniques/T1485/decommissioned_buckets/web_cloudfront_access.log --index attack_data
Manual Import
- Download the dataset files from the paths listed above
- Configure your Splunk instance with the appropriate sourcetypes
- Import the logs using the Splunk Add Data wizard
Related Content
Find more detections and analytics for this attack technique in our security content repository.
Source: GitHub | Version: 1.0