Detect S3 access from a new IP

SPLUNK detection rule by Bhavin Patel, Splunk · Apache-2.0

The following analytic identifies access to an S3 bucket from a new or previously unseen remote IP address. It leverages S3 bucket-access logs, specifically focusing on successful access events (http_status=200). This activity is significant because access from unfamiliar IP addresses could indicate unauthorized access or potential data exfiltration attempts. If confirmed malicious, this activity could lead to unauthorized data access, data theft, or further exploitation of the compromised S3 bucket, posing a significant risk to sensitive information stored within the bucket.

name: Detect S3 access from a new IP
id: e6f1bb1b-f441-492b-9126-902acda217da
version: 8
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: experimental
type: Anomaly
description: The following analytic identifies access to an S3 bucket from a new or previously unseen remote IP address. It leverages S3 bucket-access logs, specifically focusing on successful access events (http_status=200). This activity is significant because access from unfamiliar IP addresses could indicate unauthorized access or potential data exfiltration attempts. If confirmed malicious, this activity could lead to unauthorized data access, data theft, or further exploitation of the compromised S3 bucket, posing a significant risk to sensitive information stored within the bucket.
data_source: []
search: |-
    `aws_s3_accesslogs` http_status=200  [search `aws_s3_accesslogs` http_status=200
      | stats earliest(_time) as firstTime latest(_time) as lastTime
        BY bucket_name remote_ip
      | inputlookup append=t previously_seen_S3_access_from_remote_ip
      | stats min(firstTime) as firstTime, max(lastTime) as lastTime
        BY bucket_name remote_ip
      | outputlookup previously_seen_S3_access_from_remote_ip
      | eval newIP=if(firstTime >= relative_time(now(), "-70m@m"), 1, 0)
      | where newIP=1
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | table bucket_name remote_ip]
      | iplocation remote_ip
      | rename remote_ip as src_ip
      | table _time bucket_name src_ip City Country operation request_uri
      | `detect_s3_access_from_a_new_ip_filter`
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names.
known_false_positives: S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
references: []
intermediate_findings:
    entities:
        - field: bucketName
          type: other
          score: 20
          message: New S3 access from a new IP - $src_ip$
threat_objects:
    - field: src_ip
      type: ip_address
analytic_story:
    - Suspicious AWS S3 Activities
asset_type: S3 Bucket
mitre_attack_id:
    - T1530
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: network
baselines:
    - Previously seen S3 bucket access by remote IP

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6338d1cd-d88e-491f-8aea-3b9a7bf3e14c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion