Skip to main content

AWS API calls indicating S3 privilege escalation

ID:aws_privilege_escalation_s3
Data type:AWS CloudTrail
Severity:
Low
MITRE ATT&CK:TA0004:T1484

Description​

AlphaSOC detected AWS API calls that indicate potential privilege escalation regarding AWS S3 permissions. Threat actors may modify these permissions to gain unauthorized access to sensitive data stored in S3 buckets.

Impact​

This activity could allow threat actors to access, exfiltrate, modify, or delete sensitive data stored in S3 buckets. Successful privilege escalation may lead to data breaches, compliance violations, and enable lateral movement within the AWS environment.

Severity​

SeverityCondition
Low
AWS API calls indicating S3 privilege escalation

Investigation and Remediation​

Review CloudTrail logs to identify the specific API calls made and the IAM principal responsible for the changes. Verify whether the changes were authorized and align with organizational policies. If unauthorized, immediately revert permission changes, revoke compromised credentials, and conduct a comprehensive audit for additional suspicious activities or persistence mechanisms.