analyzing-cloud-storage-access-patterns

Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.

跳到安装查看文件

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年8月2日 16:32
检测到的 SKILL.md 语言: 英语
星标: 33,552
分支: 4,068

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 AI 助手安装

复制这段 Prompt，发给你正在使用的 AI 助手。

Follow https://skillsmp.com/skill-install/prompt.md to install only the Agent Skill at https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-cloud-storage-access-patterns.

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-cloud-storage-access-patterns

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

4 个文件

SKILL.md

来源说明 · 只读预览

name: analyzing-cloud-storage-access-patterns
description: Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.
domain: cybersecurity
subdomain: cloud-security
tags: ["cloud-security","aws-s3","gcs","azure-blob-storage","cloudtrail","data-access-anomaly","exfiltration-detection"]
version: 1.0
author: mahipal
license: Apache-2.0
atlas_techniques: ["AML.T0024","AML.T0056"]
nist_ai_rmf: ["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
nist_csf: ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack: ["T1530","T1567.002","T1619","T1078.004","T1048"]

# Analyzing Cloud Storage Access Patterns ## When to Use - When investigating security incidents that require analyzing cloud storage access patterns - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Familiarity with cloud security concepts and tools - Access to a test or lab environment for safe execution - Python 3.8+ with required dependencies installed - Appropriate authorization for any testing activities ## Instructions 1. Install dependencies: `pip install boto3 requests` 2. Query CloudTrail for S3 Data Events using AWS CLI or boto3. 3. Build access baselines: hourly request volume, per-user object counts, source IP history. 4. Detect anomalies: - After-hours access (outside 8am-6pm local time) - Bulk downloads: >100 GetObject calls from single principal in 1 hour - New source IPs not seen in the prior 30 days - ListBucket enumeration spikes (reconnaissance indicator) 5. Generate prioritized findings report. ```bash python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json ``` ## Examples ### CloudTrail S3 Data Event ```json {"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"}, "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}} ```

在 GitHub 查看

返回搜索返回安装

conducting-gdpr-compliance-assessment

Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.

2026-08-24

analyzing-kubernetes-audit-logs

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '

2026-08-23

auditing-kubernetes-rbac-privilege-escalation

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.

2026-08-23

查看这个仓库的全部 Skills

analyzing-cloud-storage-access-patterns

来源信息

安装方式

用 AI 助手安装

检查来源文件

同仓库更多 Skills

用 AI 助手安装

同仓库更多 Skills