analyzing-cloud-storage-access-patterns

1# Analyzing Cloud Storage Access Patterns
2 
3 
4## When to Use
5 
6- When investigating security incidents that require analyzing cloud storage access patterns
7- When building detection rules or threat hunting queries for this domain
8- When SOC analysts need structured procedures for this analysis type
9- When validating security monitoring coverage for related attack techniques
10 
11## Prerequisites
12 
13- Familiarity with cloud security concepts and tools
14- Access to a test or lab environment for safe execution
15- Python 3.8+ with required dependencies installed
16- Appropriate authorization for any testing activities
17 
18## Instructions
19 
201. Install dependencies: `pip install boto3 requests`
212. Query CloudTrail for S3 Data Events using AWS CLI or boto3.
223. Build access baselines: hourly request volume, per-user object counts, source IP history.
234. Detect anomalies:
24   - After-hours access (outside 8am-6pm local time)
25   - Bulk downloads: >100 GetObject calls from single principal in 1 hour
26   - New source IPs not seen in the prior 30 days
27   - ListBucket enumeration spikes (reconnaissance indicator)
285. Generate prioritized findings report.
29 
30```bash
31python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json
32```
33 
34## Examples
35 
36### CloudTrail S3 Data Event
37```json
38{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
39…