Impact (TA0040)(opens in a new tab or window)
from logs-aws.cloudtrail*
| where event.provider == "s3.amazonaws.com" and aws.cloudtrail.error_code == "AccessDenied"
// keep only relevant fields
| keep tls.client.server_name, source.address, cloud.account.id
| stats failed_requests = count(*) by tls.client.server_name, source.address, cloud.account.id
// can modify the failed request count or tweak time window to fit environment
// can add `not cloud.account.id in (KNOWN)` or specify in exceptions
| where failed_requests > 40
Install detection rules in Elastic Security
Detect AWS S3 Bucket Enumeration or Brute Force in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).