Operation Poisson OPSEC Failure: Public Cloud Storage Bucket Exposure
Detects unauthenticated or anonymous access attempts to cloud storage buckets, specifically targeting Azure Blob Storage and AWS S3. The rule identifies access to publicly exposed buckets or those with anonymous access enabled, including specific bucket names associated with known OPSEC failures (pois43, w456w5, sentiwaw). This could indicate data exposure or reconnaissance by unauthorized actors.
Microsoft Sentinel (KQL)
