Rule Info
Name
AWS Bucket Block Public Access Weakened
Author
Shoban Chiddarth
Description
Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs.
Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.
Reference
Date
2026-10-21 00:00:00
Modified
None
Id
ab18a523-e093-4ac6-8303-8c47431f4fca
Tags
attack.defense-impairment attack.t1686.001
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Shoban Chiddarth
Merge PR #6118 from @ShobanChiddarth - Add AWS Cloudtrail S3 bucket Block Public Access settings weakened
2026-10-21
Scan your endpoints, forensic images or collected files with our portable scanner THOR