AWS Bucket Block Public Access Weakened

SigmaHQ Detections@sigmaHQ

•updated 2 days ago•0•0•4

Detects the weakening of "Block Public Access" setting of S3 buckets in CloudTrail logs. Monitoring changes to Block Public Access settings is critical, as attackers may disable these safeguards before exposing a bucket through a public ACL or bucket policy.