← LeaderboardThe Skill Leaderboard

analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

analyzing-cloud-storage-access-patterns

Start a fresh conversation. Replace the highlighted placeholders.

Use analyzing-cloud-storage-access-patterns to analyze authorized cloud-storage access logs for [storage scope] over [time range], baseline access behavior, and produce prioritized findings for anomalous downloads, new-IP access, and API-call spikes

Required inputs

  • [storage scope]
  • [time range]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: analyzing-cloud-storage-access-patternsdescription: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.domain: cybersecuritysubdomain: cloud-securitytags: - cloud-security- aws-s3- gcs- azure-blob-storage- cloudtrail- data-access-anomaly- exfiltration-detectionversion: '1.0'author: mahipallicense: Apache-2.0atlas_techniques: - AML.T0024- AML.T0056nist_ai_rmf: - MEASURE-2.7- MAP-5.1- MANAGE-2.4nist_csf: - PR.IR-01- ID.AM-08- GV.SC-06- DE.CM-01mitre_attack: - T1530- T1567.002- T1619- T1078.004- T1048

Analyzing Cloud Storage Access Patterns

When to Use

  • When investigating security incidents that require analyzing cloud storage access patterns
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with cloud security concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install boto3 requests
  2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.
  3. Build access baselines: hourly request volume, per-user object counts, source IP history.
  4. Detect anomalies:
    • After-hours access (outside 8am-6pm local time)
    • Bulk downloads: >100 GetObject calls from single principal in 1 hour
    • New source IPs not seen in the prior 30 days
    • ListBucket enumeration spikes (reconnaissance indicator)
  5. Generate prioritized findings report.
python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json

Examples

CloudTrail S3 Data Event

{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}