[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEH9NPSV5Z27WN5GQWAF46":3,"skill-same:01M6AEH9NPSV5Z27WN5GQWAF46":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AEH9NPSV5Z27WN5GQWAF46","detecting-s3-data-exfiltration-attempts",null,"Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"detecting s3 data exfiltration attempts","s3","data","exfiltration","threat-detection","macie","guardduty","detection","aws","flow","analyzing","data-exfiltration","security","cloudtrail","downloads","cloud-security","cloud","logs","pr","cybersecurity","2026-11-10 10:12:30",false,"---\nname: detecting-s3-data-exfiltration-attempts\ndescription: 'Detecting data exfiltration attempts from AWS S3 buckets by analyzing\n  CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts,\n  and S3 access patterns to identify unauthorized bulk downloads and cross-account\n  data transfers.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- s3\n- data-exfiltration\n- guardduty\n- macie\n- threat-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1530\n- T1567.002\n- T1537\n- T1119\n---\n\n# Detecting S3 Data Exfiltration Attempts\n\n## When to Use\n\n- When GuardDuty detects anomalous S3 access patterns such as bulk downloads from unusual IPs\n- When investigating suspected data breach involving S3-stored sensitive data\n- When building detection rules for S3 data loss prevention monitoring\n- When responding to Macie alerts about sensitive data being accessed or moved\n- When compliance requires monitoring and logging of all access to classified data stores\n\n**Do not use** for preventing data exfiltration (use S3 bucket policies, VPC endpoints, and SCPs), for data classification (use Amazon Macie discovery jobs), or for network-level exfiltration detection (use VPC Flow Logs with network analysis tools).\n\n## Prerequisites\n\n- CloudTrail configured with S3 data event logging (`GetObject`, `PutObject`, `CopyObject`)\n- GuardDuty enabled with S3 Protection feature activated\n- Amazon Macie enabled for sensitive data discovery in target buckets\n- CloudWatch Logs or Athena for querying CloudTrail logs at scale\n- VPC endpoint policies configured for S3 access monitoring\n\n## Workflow\n\n### Step 1: Enable S3 Data Event Logging in CloudTrail\n\nConfigure CloudTrail to capture all S3 object-level operations for forensic analysis.\n\n```bash\n# Enable S3 data events on an existing trail\naws cloudtrail put-event-selectors \\\n  --trail-name management-trail \\\n  --event-selectors '[{\n    \"ReadWriteType\": \"All\",\n    \"IncludeManagementEvents\": true,\n    \"DataResources\": [{\n      \"Type\": \"AWS::S3::Object\",\n      \"Values\": [\"arn:aws:s3:::sensitive-data-bucket\u002F\", \"arn:aws:s3:::customer-records\u002F\"]\n    }]\n  }]'\n\n# Verify data event configuration\naws cloudtrail get-event-selectors --trail-name management-trail \\\n  --query 'EventSelectors[*].DataResources' --output json\n\n# Enable GuardDuty S3 Protection\naws guardduty update-detector \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --data-sources '{\"S3Logs\":{\"Enable\":true}}'\n```\n\n### Step 2: Query CloudTrail for Anomalous S3 Access Patterns\n\nAnalyze CloudTrail logs for bulk download activity, unusual access times, and unfamiliar source IPs.\n\n```bash\n# Athena query: Top S3 downloaders by volume in last 24 hours\ncat \u003C\u003C 'EOF'\nSELECT\n  useridentity.arn as principal,\n  sourceipaddress,\n  COUNT(*) as request_count,\n  SUM(CAST(json_extract_scalar(requestparameters, '$.bytesTransferredOut') AS bigint)) as bytes_downloaded\nFROM cloudtrail_logs\nWHERE eventname = 'GetObject'\n  AND eventsource = 's3.amazonaws.com'\n  AND eventtime > date_add('hour', -24, now())\nGROUP BY useridentity.arn, sourceipaddress\nORDER BY request_count DESC\nLIMIT 50\nEOF\n\n# CloudWatch Logs Insights: S3 GetObject requests from unusual IPs\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"24 hours ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, requestParameters.bucketName, requestParameters.key\n    | filter eventName = \"GetObject\"\n    | stats count() as requestCount by sourceIPAddress, userIdentity.arn\n    | sort requestCount desc\n    | limit 25\n  '\n\n# Detect cross-account copies (potential exfiltration)\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"7 days ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, requestParameters.bucketName\n    | filter eventName in [\"CopyObject\", \"ReplicateObject\", \"UploadPart\"]\n    | filter userIdentity.accountId != \"OUR_ACCOUNT_ID\"\n    | sort @timestamp desc\n    | limit 100\n  '\n```\n\n### Step 3: Review GuardDuty S3 Findings\n\nCheck for GuardDuty S3-specific finding types that indicate exfiltration activity.\n\n```bash\n# List active S3 exfiltration-related findings\naws guardduty list-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-criteria '{\n    \"Criterion\": {\n      \"type\": {\n        \"Eq\": [\n          \"Exfiltration:S3\u002FMaliciousIPCaller\",\n          \"Exfiltration:S3\u002FObjectRead.Unusual\",\n          \"Discovery:S3\u002FMaliciousIPCaller.Custom\",\n          \"Discovery:S3\u002FBucketEnumeration.Unusual\",\n          \"UnauthorizedAccess:S3\u002FMaliciousIPCaller.Custom\",\n          \"UnauthorizedAccess:S3\u002FTorIPCaller\",\n          \"Impact:S3\u002FAnomalousBehavior.Delete\"\n        ]\n      }\n    }\n  }' --output json\n\n# Get detailed finding information\naws guardduty get-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-ids FINDING_IDS \\\n  --query 'Findings[*].{Type:Type,Severity:Severity,Resource:Resource.S3BucketDetails[0].Name,Action:Service.Action}' \\\n  --output table\n```\n\n### Step 4: Analyze Macie Findings for Sensitive Data Access\n\nReview Macie findings to correlate data sensitivity with access anomalies.\n\n```bash\n# List Macie findings for sensitive data exposure\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"category\": {\"eq\": [\"CLASSIFICATION\"]},\n      \"severity.description\": {\"eq\": [\"High\", \"Critical\"]}\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}' \\\n  --max-results 25\n\n# Get detailed finding with data classification\naws macie2 get-findings \\\n  --finding-ids FINDING_IDS \\\n  --query 'findings[*].{Type:type,Severity:severity.description,Bucket:resourcesAffected.s3Bucket.name,SensitiveDataTypes:classificationDetails.result.sensitiveData[*].category}' \\\n  --output table\n\n# Run a sensitive data discovery job on target bucket\naws macie2 create-classification-job \\\n  --job-type ONE_TIME \\\n  --name \"exfiltration-investigation\" \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"ACCOUNT_ID\",\n      \"buckets\": [\"sensitive-data-bucket\"]\n    }]\n  }'\n```\n\n### Step 5: Build Automated Detection Rules\n\nCreate CloudWatch alarms and EventBridge rules for real-time exfiltration detection.\n\n```bash\n# CloudWatch metric filter for high-volume S3 downloads\naws logs put-metric-filter \\\n  --log-group-name cloudtrail-logs \\\n  --filter-name s3-bulk-download \\\n  --filter-pattern '{$.eventName = \"GetObject\" && $.eventSource = \"s3.amazonaws.com\"}' \\\n  --metric-transformations '[{\n    \"metricName\": \"S3GetObjectCount\",\n    \"metricNamespace\": \"SecurityMetrics\",\n    \"metricValue\": \"1\",\n    \"defaultValue\": 0\n  }]'\n\n# Alarm for anomalous download volume (>1000 objects\u002Fhour)\naws cloudwatch put-metric-alarm \\\n  --alarm-name s3-exfiltration-alert \\\n  --metric-name S3GetObjectCount \\\n  --namespace SecurityMetrics \\\n  --statistic Sum \\\n  --period 3600 \\\n  --threshold 1000 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 1 \\\n  --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:security-alerts\n\n# EventBridge rule for GuardDuty S3 findings\naws events put-rule \\\n  --name guardduty-s3-exfiltration \\\n  --event-pattern '{\n    \"source\": [\"aws.guardduty\"],\n    \"detail-type\": [\"GuardDuty Finding\"],\n    \"detail\": {\n      \"type\": [{\"prefix\": \"Exfiltration:S3\u002F\"}]\n    }\n  }'\n```\n\n### Step 6: Implement Preventive Controls\n\nDeploy bucket policies and VPC endpoint policies to restrict data movement paths.\n\n```bash\n# VPC endpoint policy restricting S3 access to specific buckets\naws ec2 modify-vpc-endpoint \\\n  --vpc-endpoint-id vpce-ENDPOINT_ID \\\n  --policy-document '{\n    \"Statement\": [{\n      \"Sid\": \"RestrictToOwnBuckets\",\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": [\"s3:GetObject\", \"s3:PutObject\"],\n      \"Resource\": [\"arn:aws:s3:::approved-bucket-1\u002F*\", \"arn:aws:s3:::approved-bucket-2\u002F*\"]\n    }]\n  }'\n\n# Bucket policy denying access from outside the VPC\naws s3api put-bucket-policy --bucket sensitive-data-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Sid\": \"DenyNonVpcAccess\",\n    \"Effect\": \"Deny\",\n    \"Principal\": \"*\",\n    \"Action\": \"s3:GetObject\",\n    \"Resource\": \"arn:aws:s3:::sensitive-data-bucket\u002F*\",\n    \"Condition\": {\n      \"StringNotEquals\": {\n        \"aws:sourceVpce\": \"vpce-ENDPOINT_ID\"\n      }\n    }\n  }]\n}'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| S3 Data Events | CloudTrail object-level logging that captures GetObject, PutObject, DeleteObject, and CopyObject API calls with request details |\n| GuardDuty S3 Protection | Threat detection feature analyzing CloudTrail S3 data events to identify anomalous access patterns and exfiltration attempts |\n| Amazon Macie | Data security service that discovers and classifies sensitive data in S3 and generates findings for data exposure risks |\n| VPC Endpoint Policy | Access control policy on an S3 VPC endpoint that restricts which buckets and actions can be accessed through the endpoint |\n| Data Exfiltration | Unauthorized transfer of data from an organization's S3 storage to an external location controlled by an attacker |\n| Anomalous Behavior Detection | Machine learning-based identification of S3 access patterns that deviate from established baselines for a principal |\n\n## Tools & Systems\n\n- **AWS CloudTrail**: Audit logging of S3 object-level operations for forensic analysis and anomaly detection\n- **Amazon GuardDuty**: ML-based threat detection with S3-specific finding types for exfiltration and unauthorized access\n- **Amazon Macie**: Sensitive data discovery and classification for correlating access anomalies with data sensitivity\n- **Amazon Athena**: SQL query engine for analyzing CloudTrail logs at scale to identify bulk download patterns\n- **CloudWatch Logs Insights**: Real-time log analysis for building detection queries against CloudTrail data\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Bulk S3 Data Download\n\n**Context**: GuardDuty reports an `Exfiltration:S3\u002FObjectRead.Unusual` finding indicating that a developer's access key is downloading thousands of objects from a sensitive data bucket at 3 AM from an IP address in a foreign country.\n\n**Approach**:\n1. Immediately deactivate the compromised access key\n2. Query CloudTrail for all S3 actions by the compromised principal in the last 72 hours\n3. Identify which buckets and objects were accessed using Athena queries\n4. Cross-reference accessed objects with Macie classifications to assess data sensitivity\n5. Check for CopyObject calls to external accounts (cross-account exfiltration)\n6. Review how the credentials were compromised (TruffleHog scan, phishing investigation)\n7. Implement VPC endpoint policies to restrict future S3 access to approved network paths\n\n**Pitfalls**: CloudTrail S3 data events can generate massive log volume. Use Athena with partitioned tables rather than CloudWatch Logs Insights for queries spanning more than 24 hours. GuardDuty baseline learning requires 7-14 days, so new accounts may generate false positives for normal access patterns.\n\n## Output Format\n\n```\nS3 Data Exfiltration Investigation Report\n============================================\nAccount: 123456789012\nDetection Source: GuardDuty Exfiltration:S3\u002FObjectRead.Unusual\nInvestigation Date: 2026-02-23\n\nINCIDENT TIMELINE:\n  2026-02-23 02:47 UTC - First anomalous GetObject from 185.x.x.x\n  2026-02-23 02:47-04:12 UTC - 12,847 GetObject requests\n  2026-02-23 04:15 UTC - GuardDuty finding generated\n  2026-02-23 04:20 UTC - PagerDuty alert received by SOC\n  2026-02-23 04:25 UTC - Access key deactivated\n\nCOMPROMISED PRINCIPAL:\n  ARN: arn:aws:iam::123456789012:user\u002Fdeveloper-jane\n  Access Key: AKIA...WXYZ\n  Source IP: 185.x.x.x (Tor exit node)\n\nDATA IMPACT ASSESSMENT:\n  Buckets accessed: 3\n  Objects downloaded: 12,847\n  Total data volume: 4.7 GB\n  Sensitive data types: PII (SSN, email), Financial (credit card)\n  Macie severity: CRITICAL\n\nCONTAINMENT ACTIONS:\n  [x] Access key deactivated\n  [x] User password reset and MFA re-enrolled\n  [x] VPC endpoint policy applied to sensitive buckets\n  [x] Bucket policy restricting to VPC-only access\n  [x] TruffleHog scan initiated on developer repositories\n```\n","# Detecting S3 Data Exfiltration Attempts\n\n## When to Use\n\n- When GuardDuty detects anomalous S3 access patterns such as bulk downloads from unusual IPs\n- When investigating suspected data breach involving S3-stored sensitive data\n- When building detection rules for S3 data loss prevention monitoring\n- When responding to Macie alerts about sensitive data being accessed or moved\n- When compliance requires monitoring and logging of all access to classified data stores\n\n**Do not use** for preventing data exfiltration (use S3 bucket policies, VPC endpoints, and SCPs), for data classification (use Amazon Macie discovery jobs), or for network-level exfiltration detection (use VPC Flow Logs with network analysis tools).\n\n## Prerequisites\n\n- CloudTrail configured with S3 data event logging (`GetObject`, `PutObject`, `CopyObject`)\n- GuardDuty enabled with S3 Protection feature activated\n- Amazon Macie enabled for sensitive data discovery in target buckets\n- CloudWatch Logs or Athena for querying CloudTrail logs at scale\n- VPC endpoint policies configured for S3 access monitoring\n\n## Workflow\n\n### Step 1: Enable S3 Data Event Logging in CloudTrail\n\nConfigure CloudTrail to capture all S3 object-level operations for forensic analysis.\n\n```bash\n# Enable S3 data events on an existing trail\naws cloudtrail put-event-selectors \\\n  --trail-name management-trail \\\n  --event-selectors '[{\n    \"ReadWriteType\": \"All\",\n    \"IncludeManagementEvents\": true,\n    \"DataResources\": [{\n      \"Type\": \"AWS::S3::Object\",\n      \"Values\": [\"arn:aws:s3:::sensitive-data-bucket\u002F\", \"arn:aws:s3:::customer-records\u002F\"]\n    }]\n  }]'\n\n# Verify data event configuration\naws cloudtrail get-event-selectors --trail-name management-trail \\\n  --query 'EventSelectors[*].DataResources' --output json\n\n# Enable GuardDuty S3 Protection\naws guardduty update-detector \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --data-sources '{\"S3Logs\":{\"Enable\":true}}'\n```\n\n### Step 2: Query CloudTrail for Anomalous S3 Access Patterns\n\nAnalyze CloudTrail logs for bulk download activity, unusual access times, and unfamiliar source IPs.\n\n```bash\n# Athena query: Top S3 downloaders by volume in last 24 hours\ncat \u003C\u003C 'EOF'\nSELECT\n  useridentity.arn as principal,\n  sourceipaddress,\n  COUNT(*) as request_count,\n  SUM(CAST(json_extract_scalar(requestparameters, '$.bytesTransferredOut') AS bigint)) as bytes_downloaded\nFROM cloudtrail_logs\nWHERE eventname = 'GetObject'\n  AND eventsource = 's3.amazonaws.com'\n  AND eventtime > date_add('hour', -24, now())\nGROUP BY useridentity.arn, sourceipaddress\nORDER BY request_count DESC\nLIMIT 50\nEOF\n\n# CloudWatch Logs Insights: S3 GetObject requests from unusual IPs\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"24 hours ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, requestParameters.bucketName, requestParameters.key\n    | filter eventName = \"GetObject\"\n    | stats count() as requestCount by sourceIPAddress, userIdentity.arn\n    | sort requestCount desc\n    | limit 25\n  '\n\n# Detect cross-account copies (potential exfiltration)\naws logs start-query \\\n  --log-group-name cloudtrail-logs \\\n  --start-time $(date -d \"7 days ago\" +%s) \\\n  --end-time $(date +%s) \\\n  --query-string '\n    fields @timestamp, userIdentity.arn, sourceIPAddress, requestParameters.bucketName\n    | filter eventName in [\"CopyObject\", \"ReplicateObject\", \"UploadPart\"]\n    | filter userIdentity.accountId != \"OUR_ACCOUNT_ID\"\n    | sort @timestamp desc\n    | limit 100\n  '\n```\n\n### Step 3: Review GuardDuty S3 Findings\n\nCheck for GuardDuty S3-specific finding types that indicate exfiltration activity.\n\n```bash\n# List active S3 exfiltration-related findings\naws guardduty list-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-criteria '{\n    \"Criterion\": {\n      \"type\": {\n        \"Eq\": [\n          \"Exfiltration:S3\u002FMaliciousIPCaller\",\n          \"Exfiltration:S3\u002FObjectRead.Unusual\",\n          \"Discovery:S3\u002FMaliciousIPCaller.Custom\",\n          \"Discovery:S3\u002FBucketEnumeration.Unusual\",\n          \"UnauthorizedAccess:S3\u002FMaliciousIPCaller.Custom\",\n          \"UnauthorizedAccess:S3\u002FTorIPCaller\",\n          \"Impact:S3\u002FAnomalousBehavior.Delete\"\n        ]\n      }\n    }\n  }' --output json\n\n# Get detailed finding information\naws guardduty get-findings \\\n  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \\\n  --finding-ids FINDING_IDS \\\n  --query 'Findings[*].{Type:Type,Severity:Severity,Resource:Resource.S3BucketDetails[0].Name,Action:Service.Action}' \\\n  --output table\n```\n\n### Step 4: Analyze Macie Findings for Sensitive Data Access\n\nReview Macie findings to correlate data sensitivity with access anomalies.\n\n```bash\n# List Macie findings for sensitive data exposure\naws macie2 list-findings \\\n  --finding-criteria '{\n    \"criterion\": {\n      \"category\": {\"eq\": [\"CLASSIFICATION\"]},\n      \"severity.description\": {\"eq\": [\"High\", \"Critical\"]}\n    }\n  }' \\\n  --sort-criteria '{\"attributeName\": \"updatedAt\", \"orderBy\": \"DESC\"}' \\\n  --max-results 25\n\n# Get detailed finding with data classification\naws macie2 get-findings \\\n  --finding-ids FINDING_IDS \\\n  --query 'findings[*].{Type:type,Severity:severity.description,Bucket:resourcesAffected.s3Bucket.name,SensitiveDataTypes:classificationDetails.result.sensitiveData[*].category}' \\\n  --output table\n\n# Run a sensitive data discovery job on target bucket\naws macie2 create-classification-job \\\n  --job-type ONE_TIME \\\n  --name \"exfiltration-investigation\" \\\n  --s3-job-definition '{\n    \"bucketDefinitions\": [{\n      \"accountId\": \"ACCOUNT_ID\",\n      \"buckets\": [\"sensitive-data-bucket\"]\n    }]\n  }'\n```\n\n### Step 5: Build Automated Detection Rules\n\nCreate CloudWatch alarms and EventBridge rules for real-time exfiltration detection.\n\n```bash\n# CloudWatch metric filter for high-volume S3 downloads\naws logs put-metric-filter \\\n  --log-group-name cloudtrail-logs \\\n  --filter-name s3-bulk-download \\\n  --filter-pattern '{$.eventName = \"GetObject\" && $.eventSource = \"s3.amazonaws.com\"}' \\\n  --metric-transformations '[{\n    \"metricName\": \"S3GetObjectCount\",\n    \"metricNamespace\": \"SecurityMetrics\",\n    \"metricValue\": \"1\",\n    \"defaultValue\": 0\n  }]'\n\n# Alarm for anomalous download volume (>1000 objects\u002Fhour)\naws cloudwatch put-metric-alarm \\\n  --alarm-name s3-exfiltration-alert \\\n  --metric-name S3GetObjectCount \\\n  --namespace SecurityMetrics \\\n  --statistic Sum \\\n  --period 3600 \\\n  --threshold 1000 \\\n  --comparison-operator GreaterThanThreshold \\\n  --evaluation-periods 1 \\\n  --alarm-actions arn:aws:sns:us-east-1:ACCOUNT:security-alerts\n\n# EventBridge rule for GuardDuty S3 findings\naws events put-rule \\\n  --name guardduty-s3-exfiltration \\\n  --event-pattern '{\n    \"source\": [\"aws.guardduty\"],\n    \"detail-type\": [\"GuardDuty Finding\"],\n    \"detail\": {\n      \"type\": [{\"prefix\": \"Exfiltration:S3\u002F\"}]\n    }\n  }'\n```\n\n### Step 6: Implement Preventive Controls\n\nDeploy bucket policies and VPC endpoint policies to restrict data movement paths.\n\n```bash\n# VPC endpoint policy restricting S3 access to specific buckets\naws ec2 modify-vpc-endpoint \\\n  --vpc-endpoint-id vpce-ENDPOINT_ID \\\n  --policy-document '{\n    \"Statement\": [{\n      \"Sid\": \"RestrictToOwnBuckets\",\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": [\"s3:GetObject\", \"s3:PutObject\"],\n      \"Resource\": [\"arn:aws:s3:::approved-bucket-1\u002F*\", \"arn:aws:s3:::approved-bucket-2\u002F*\"]\n    }]\n  }'\n\n# Bucket policy denying access from outside the VPC\naws s3api put-bucket-policy --bucket sensitive-data-bucket --policy '{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Sid\": \"DenyNonVpcAccess\",\n    \"Effect\": \"Deny\",\n    \"Principal\": \"*\",\n    \"Action\": \"s3:GetObject\",\n    \"Resource\": \"arn:aws:s3:::sensitive-data-bucket\u002F*\",\n    \"Condition\": {\n      \"StringNotEquals\": {\n        \"aws:sourceVpce\": \"vpce-ENDPOINT_ID\"\n      }\n    }\n  }]\n}'\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| S3 Data Events | CloudTrail object-level logging that captures GetObject, PutObject, DeleteObject, and CopyObject API calls with request details |\n| GuardDuty S3 Protection | Threat detection feature analyzing CloudTrail S3 data events to identify anomalous access patterns and exfiltration attempts |\n| Amazon Macie | Data security service that discovers and classifies sensitive data in S3 and generates findings for data exposure risks |\n| VPC Endpoint Policy | Access control policy on an S3 VPC endpoint that restricts which buckets and actions can be accessed through the endpoint |\n| Data Exfiltration | Unauthorized transfer of data from an organization's S3 storage to an external location controlled by an attacker |\n| Anomalous Behavior Detection | Machine learning-based identification of S3 access patterns that deviate from established baselines for a principal |\n\n## Tools & Systems\n\n- **AWS CloudTrail**: Audit logging of S3 object-level operations for forensic analysis and anomaly detection\n- **Amazon GuardDuty**: ML-based threat detection with S3-specific finding types for exfiltration and unauthorized access\n- **Amazon Macie**: Sensitive data discovery and classification for correlating access anomalies with data sensitivity\n- **Amazon Athena**: SQL query engine for analyzing CloudTrail logs at scale to identify bulk download patterns\n- **CloudWatch Logs Insights**: Real-time log analysis for building detection queries against CloudTrail data\n\n## Common Scenarios\n\n### Scenario: Compromised IAM Credentials Used for Bulk S3 Data Download\n\n**Context**: GuardDuty reports an `Exfiltration:S3\u002FObjectRead.Unusual` finding indicating that a developer's access key is downloading thousands of objects from a sensitive data bucket at 3 AM from an IP address in a foreign country.\n\n**Approach**:\n1. Immediately deactivate the compromised access key\n2. Query CloudTrail for all S3 actions by the compromised principal in the last 72 hours\n3. Identify which buckets and objects were accessed using Athena queries\n4. Cross-reference accessed objects with Macie classifications to assess data sensitivity\n5. Check for CopyObject calls to external accounts (cross-account exfiltration)\n6. Review how the credentials were compromised (TruffleHog scan, phishing investigation)\n7. Implement VPC endpoint policies to restrict future S3 access to approved network paths\n\n**Pitfalls**: CloudTrail S3 data events can generate massive log volume. Use Athena with partitioned tables rather than CloudWatch Logs Insights for queries spanning more than 24 hours. GuardDuty baseline learning requires 7-14 days, so new accounts may generate false positives for normal access patterns.\n\n## Output Format\n\n```\nS3 Data Exfiltration Investigation Report\n============================================\nAccount: 123456789012\nDetection Source: GuardDuty Exfiltration:S3\u002FObjectRead.Unusual\nInvestigation Date: 2026-02-23\n\nINCIDENT TIMELINE:\n  2026-02-23 02:47 UTC - First anomalous GetObject from 185.x.x.x\n  2026-02-23 02:47-04:12 UTC - 12,847 GetObject requests\n  2026-02-23 04:15 UTC - GuardDuty finding generated\n  2026-02-23 04:20 UTC - PagerDuty alert received by SOC\n  2026-02-23 04:25 UTC - Access key deactivated\n\nCOMPROMISED PRINCIPAL:\n  ARN: arn:aws:iam::123456789012:user\u002Fdeveloper-jane\n  Access Key: AKIA...WXYZ\n  Source IP: 185.x.x.x (Tor exit node)\n\nDATA IMPACT ASSESSMENT:\n  Buckets accessed: 3\n  Objects downloaded: 12,847\n  Total data volume: 4.7 GB\n  Sensitive data types: PII (SSN, email), Financial (credit card)\n  Macie severity: CRITICAL\n\nCONTAINMENT ACTIONS:\n  [x] Access key deactivated\n  [x] User password reset and MFA re-enrolled\n  [x] VPC endpoint policy applied to sensitive buckets\n  [x] Bucket policy restricting to VPC-only access\n  [x] TruffleHog scan initiated on developer repositories\n```\n",{"name":5,"tags":54,"author":55,"domain":48,"license":15,"version":56,"nist_csf":57,"subdomain":44,"description":62,"mitre_attack":63},[44,37,30,40,35,34,33],"mahipal","1.0",[58,59,60,61],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.\n",[64,65,66,67],"T1530","T1567.002","T1537","T1119","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-s3-data-exfiltration-attempts",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-s3-data-exfiltration-attempts",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-s3-data-exfiltration-attempts",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-s3-data-exfiltration-attempts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002FSKILL.md",true,[92,97,103,107],{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002FLICENSE",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"references\u002Fapi-reference.md","REFERENCE","参考文档",2540,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002Freferences\u002Fapi-reference.md",{"path":104,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Ffix-and-verify.md",4636,"https:\u002F\u002Fgithub.com\u002Fkevinpita\u002Fnixos-config\u002Fblob\u002Fmain\u002Fagents\u002Fskills\u002Fthermo-loop\u002Freferences\u002Ffix-and-verify.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fagent.py","SCRIPT","脚本",8238,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-s3-data-exfiltration-attempts\u002Fscripts\u002Fagent.py",[114,139,163,190,214,241],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":121,"publishedAt":49},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[120],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[122,123,124,125,41,48,126,127,47,128,129,130,131,132,133,134,135,136,137,138],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":140,"name":141,"nameZh":6,"description":142,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":143,"categories":144,"keywords":146,"publishedAt":49},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[145],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[147,135,148,149,41,150,48,47,151,152,153,154,155,156,157,158,159,160,161,162],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":173,"publishedAt":49},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[169,172],{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,174,175,176,177,48,178,179,151,180,181,182,183,184,36,185,186,187,188,189],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":197,"publishedAt":49},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[196],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[198,199,200,48,201,202,46,203,204,205,206,31,207,208,209,210,154,211,212,213],"windows","kape","triaging windows with kape","registry","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":221,"publishedAt":49},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[220],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[222,223,224,48,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":248,"publishedAt":49},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[247],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[41,249,48,250,251,252,253,254,255,256,257,185,258,186,259,260,261,262,263,264],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]