Potential AWS S3 Bucket Enumeration via ListBuckets

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•48

This rule detects potential enumeration of AWS S3 buckets by looking for the 'ListBuckets' API call in AWS CloudTrail logs. It specifically filters out activities performed by 'AssumedRole' identities to reduce false positives from legitimate automated processes or services.