skills.rest
balsm-health
balsm-healthOFFICIAL
Explore all skills by this author →
Website𝕏@balsm_healthGitHub

detecting-s3-data-exfiltration-attempts

Detect AWS S3 data exfiltration attempts by analyzing CloudTrail logs.

2|Updated Jun 5, 2026
Search Tags:#s3#data exfiltration#cloudtrail#guardduty#macie
One-click install
npx skills add https://github.com/balsm-health/Balsm-AI --skill detecting-s3-data-exfiltration-attempts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-s3-data-exfiltration-attempts
Source: https://github.com/balsm-health/Balsm-AI/tree/main/plugin/skills/detecting-s3-data-exfiltration-attempts
Command: npx skills add https://github.com/balsm-health/Balsm-AI --skill detecting-s3-data-exfiltration-attempts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires boto3, botocore, pandas, numpy, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Detects unauthorized bulk downloads and cross-account data transfers from AWS S3 buckets.

Core Features & Use Cases

  • CloudTrail Event Analysis: Inspects S3 data events to identify bulk download patterns.
  • GuardDuty and Macie Integration: Correlates GuardDuty findings and Macie alerts for sensitive data access.
  • VPC Endpoint Policy and Bucket Policy Configuration: Recommends VPC endpoint and bucket policies to limit data movement paths.

Quick Start

Analyze the CloudTrail and GuardDuty logs using this skill to identify S3 data exfiltration attempts.

Frequently Asked Questions about detecting-s3-data-exfiltration-attempts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect S3 data exfiltration attempts using CloudTrail logs?▼

Detect S3 data exfiltration by analyzing CloudTrail logs for suspicious activities, identifying bulk download patterns, and monitoring cross-account data transfers from your S3 buckets.

What is the best way to correlate GuardDuty findings with Macie alerts for S3 access?▼

The best way to correlate GuardDuty and Macie alerts is to cross-reference GuardDuty findings with Macie sensitive data alerts to identify unauthorized access to classified S3 objects.

Do I need AWS Athena or CloudWatch to query logs for bulk S3 downloads?▼

You need access to either CloudWatch or Athena to query CloudTrail logs for bulk S3 downloads, as the skill requires these services to inspect S3 data events.

Can I use this skill to recommend VPC endpoint policies to limit S3 data movement?▼

Yes, you can use this skill to recommend VPC endpoint policies and bucket policies that limit data movement paths, preventing unauthorized S3 exfiltration routes.

What types of S3 events indicate cross-account data transfers?▼

Cross-account data transfers are indicated by specific S3 events in CloudTrail logs that show data movement outside expected accounts, signaling potential unauthorized exfiltration attempts.

Related Skills

YukiIto1999YukiIto1999

performing-cloud-log-forensics-with-athena

Query AWS CloudTrail, VPC Flow, S3, and ALB logs with Athena.

Community
Advanced
CrashBytesCrashBytes
6

infosec-engineer

Conduct security assessments, threat modeling, and compliance reviews.

Community
Advanced
h4vzzh4vzz
33

data-analysis

Perform statistical analysis on structured datasets using pandas, numpy, scipy, and statsmodels.

Community
Intermediate
YukiIto1999YukiIto1999

detecting-aws-cloudtrail-anomalies

Detect anomalous AWS CloudTrail API activity and output a JSON report.

Community
Advanced