AWS IAM S3Browser Templated S3 Bucket Policy Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects the creation of an Inline IAM policy by the 'S3 Browser' utility, where the policy still contains the default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>" instead of a specific bucket name. This indicates a potential misconfiguration or an attempt to create a broad policy that might be further exploited.