mcpField
A
analyzing-cloud-storage-access-patterns

analyzing-cloud-storage-access-patterns

github.com/mukul975Security35.2k566 installsUpdated 8w ago
Repository

About analyzing-cloud-storage-access-patterns

A security analysis skill for cloud and SOC teams that uses AWS CloudTrail S3 data events to baseline access, detect anomalies, and produce prioritized findings.

Key features

  1. 01Query S3 data events
  2. 02Build access behavior baselines
  3. 03Detect after-hours access
  4. 04Flag bulk downloads and new IPs
  5. 05Generate prioritized findings

Use cases

  1. 01Investigate S3 access incidents
  2. 02Build access anomaly detection rules
  3. 03Validate cloud storage monitoring coverage

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-cloud-storage-access-patterns

After installing, type/analyzing-cloud-storage-access-patternsin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing Cloud Storage Access Patterns

When to Use

  • When investigating security incidents that require analyzing cloud storage access patterns
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with cloud security concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

  1. Install dependencies: pip install boto3 requests
  2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.
  3. Build access baselines: hourly request volume, per-user object counts, source IP history.
  4. Detect anomalies:
    • After-hours access (outside 8am-6pm local time)
    • Bulk downloads: >100 GetObject calls from single principal in 1 hour
    • New source IPs not seen in the prior 30 days
    • ListBucket enumeration spikes (reconnaissance indicator)
  5. Generate prioritized findings report.
python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json

Examples

CloudTrail S3 Data Event
{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}

Comments

Markdown supported