Cloud Storage Object Discovery

let LookbackWindow = 1h;
let HighVolumeThreshold = 50;
let UniqueBucketThreshold = 5;
// AWS S3 enumeration via CloudTrail
let AWSS3Discovery = AWSCloudTrail
| where TimeGenerated >= ago(LookbackWindow)
| where EventName in ("ListBuckets", "ListObjects", "ListObjectsV2", "ListObjectVersions", "ListMultipartUploads", "GetBucketAcl", "GetBucketPolicy", "GetBucketLocation")
| extend UserIdentity = coalesce(UserIdentityArn, UserIdentityUserName, UserIdentityPrincipalid)
| summarize
    OperationCount = count(),
    UniqueBuckets = dcount(tostring(RequestParameters)),
    Operations = make_set(EventName),
    SourceIPs = make_set(SourceIpAddress),
    AWSRegions = make_set(AWSRegion),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by UserIdentity, UserIdentityType, UserAgent, bin(TimeGenerated, 10m)
| where OperationCount > HighVolumeThreshold or UniqueBuckets > UniqueBucketThreshold
| extend Platform = "AWS", Severity = iff(OperationCount > 200 or UniqueBuckets > 20, "High", "Medium")
| project TimeGenerated, Platform, UserIdentity, UserIdentityType, UserAgent, OperationCount, UniqueBuckets, Operations, SourceIPs, AWSRegions, FirstSeen, LastSeen, Severity;
// Azure Blob Storage enumeration
let AzureBlobDiscovery = StorageBlobLogs
| where TimeGenerated >= ago(LookbackWindow)
| where OperationName in ("ListBlobs", "ListContainers", "GetContainerProperties", "GetBlobServiceProperties", "ListBlobsFlatSegment", "ListBlobsHierarchySegment")
| summarize
    OperationCount = count(),
    UniqueContainers = dcount(Uri),
    Operations = make_set(OperationName),
    SourceIPs = make_set(CallerIpAddress),
    Accounts = make_set(AccountName),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated)
    by AuthenticationType, RequesterObjectId, UserAgentHeader, bin(TimeGenerated, 10m)
| where OperationCount > HighVolumeThreshold or UniqueContainers > UniqueBucketThreshold
| extend
    Platform = "Azure",
    Severity = iff(OperationCount > 200 or UniqueContainers > 20, "High", "Medium"),
    UserIdentity = coalesce(RequesterObjectId, "Anonymous"),
    UserAgent = UserAgentHeader,
    AWSRegions = dynamic([])
| project TimeGenerated, Platform, UserIdentity, AuthenticationType, UserAgent, OperationCount, UniqueContainers, Operations, SourceIPs, Accounts, FirstSeen, LastSeen, Severity;
// Union and surface results
AWSS3Discovery
| union AzureBlobDiscovery
| sort by OperationCount desc

index=* (sourcetype="aws:cloudtrail" OR sourcetype="azure:monitor:storage:blob")
| eval is_aws=if(sourcetype="aws:cloudtrail", 1, 0)
| eval is_azure=if(sourcetype="azure:monitor:storage:blob", 1, 0)
| eval event_action=coalesce(eventName, operationName)
| search event_action IN (
    "ListBuckets", "ListObjects", "ListObjectsV2", "ListObjectVersions",
    "ListMultipartUploads", "GetBucketAcl", "GetBucketPolicy", "GetBucketLocation",
    "ListBlobs", "ListContainers", "GetContainerProperties",
    "GetBlobServiceProperties", "ListBlobsFlatSegment"
  )
| eval actor_identity=coalesce(userIdentity.arn, userIdentity.userName, properties.requesterObjectId, "unknown")
| eval source_ip=coalesce(sourceIPAddress, callerIpAddress, "unknown")
| eval user_agent=coalesce(userAgent, properties.userAgentHeader, "unknown")
| eval target_resource=coalesce(requestParameters.bucketName, uri, "unknown")
| bin _time span=10m
| stats
    count AS operation_count,
    dc(target_resource) AS unique_resources,
    values(event_action) AS operations_performed,
    values(source_ip) AS source_ips,
    values(user_agent) AS user_agents,
    min(_time) AS first_seen,
    max(_time) AS last_seen
    by actor_identity, _time
| where operation_count > 50 OR unique_resources > 5
| eval severity=if(operation_count > 200 OR unique_resources > 20, "high", "medium")
| eval alert_title="Cloud Storage Object Discovery: " . actor_identity . " performed " . operation_count . " listing operations across " . unique_resources . " resources"
| table _time, actor_identity, operation_count, unique_resources, operations_performed, source_ips, user_agents, first_seen, last_seen, severity, alert_title
| sort - operation_count

any where event.dataset in ("aws.cloudtrail", "azure.activitylogs", "gcp.audit") and (event.action in ("ListObjectsV2", "ListObjects", "ListBuckets", "HeadBucket", "GetBucketAcl", "GetBucketPolicy", "ListAllMyBuckets") or (event.dataset : "azure.activitylogs" and azure.activitylogs.operation_name : "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read"))

SELECT username as "Username", sourceip as "SourceIP", UTF8(payload) as "APICall", devicetime as "EventTime", CASE WHEN UTF8(payload) ILIKE '%ListBuckets%' OR UTF8(payload) ILIKE '%ListAllMyBuckets%' THEN 80 WHEN UTF8(payload) ILIKE '%ListObjectsV2%' AND eventcount > 100 THEN 75 WHEN UTF8(payload) ILIKE '%GetBucketAcl%' OR UTF8(payload) ILIKE '%GetBucketPolicy%' THEN 70 ELSE 50 END as "RiskScore" FROM events WHERE LOGSOURCETYPENAME(devicetype) IN ('Amazon AWS CloudTrail', 'Microsoft Azure', 'Google Cloud Platform') AND (UTF8(payload) ILIKE '%ListObjects%' OR UTF8(payload) ILIKE '%ListBuckets%' OR UTF8(payload) ILIKE '%GetBucketAcl%' OR UTF8(payload) ILIKE '%StorageRead%') ORDER BY "RiskScore" DESC LAST 24 HOURS

_sourceCategory=aws/cloudtrail OR _sourceCategory=azure/storage | json auto | where event_name in ("ListObjectsV2", "ListObjects", "ListBuckets", "GetBucketAcl", "GetBucketPolicy") or operation_name matches "*blobs/read*" | if(event_name = "ListBuckets" or event_name = "ListAllMyBuckets", "High", if(count > 100, "High", "Medium")) as RiskLevel | stats count by user_identity_arn, src_ip_addr, event_name, aws_region, RiskLevel | sort by count desc

rule detect_cloud_storage_discovery {
  meta:
    author = "Argus"
    description = "Detects broad cloud storage enumeration"
    severity = "HIGH"
    technique = "T1619"
  events:
    $e.metadata.event_type = "USER_RESOURCE_ACCESS"
    $e.metadata.product_name = "AWS CloudTrail"
    (
      $e.metadata.product_event_type = "ListObjectsV2" or
      $e.metadata.product_event_type = "ListBuckets" or
      $e.metadata.product_event_type = "GetBucketAcl" or
      $e.metadata.product_event_type = "ListAllMyBuckets"
    )
  match:
    $e.principal.user.userid over 5m
  condition:
    #e > 100
}

#event_simpleName=CloudApiActivity
| event_action = /ListObjects|ListBuckets|GetBucketAcl|GetBucketPolicy|StorageRead/i
| case {
    event_action = /ListBuckets|ListAllMyBuckets/i | EnumType := "Bucket Discovery";
    event_action = /ListObjects/i | EnumType := "Object Discovery";
    event_action = /GetBucketAcl|GetBucketPolicy/i | EnumType := "Policy Discovery";
    * | EnumType := "Storage Enumeration"
  }
| stats count() as ApiCallCount by UserName, CloudAccountId, EnumType
| where ApiCallCount > 50
| table([@timestamp, UserName, CloudAccountId, EnumType, ApiCallCount])