一键在 Manus 中运行任何 Skill

开始使用

analyzing-cloud-storage-access-patterns

星标1

分支0

更新时间2026年4月4日 19:33

安装

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

在 Manus 中运行

来源

YomMongkolphanna

YomMongkolphanna/SECURITY_BRAIN

打开 GitHub 仓库查看创作者相关仓库

下载

在 Manus 中运行

Analyzing Cloud Storage Access Patterns

When to Use

When investigating security incidents that require analyzing cloud storage access patterns
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install boto3 requests
Query CloudTrail for S3 Data Events using AWS CLI or boto3.
Build access baselines: hourly request volume, per-user object counts, source IP history.
Detect anomalies:
- After-hours access (outside 8am-6pm local time)
- Bulk downloads: >100 GetObject calls from single principal in 1 hour
- New source IPs not seen in the prior 30 days
- ListBucket enumeration spikes (reconnaissance indicator)
Generate prioritized findings report.

python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json

Examples

CloudTrail S3 Data Event

{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}

同仓库更多 Skills

同仓库

command-injection

YomMongkolphanna/SECURITY_BRAIN

Command injection testing methodology covering OS command injection, code injection, filter evasion, blind command injection, and shell-specific techniques for bash, PowerShell, and cmd.exe.

2026-04-301

exploit-chaining

YomMongkolphanna/SECURITY_BRAIN

Multi-step exploit chaining methodology for combining low-severity findings into full compromise paths. Covers attack chain scoring, approval gates, and systematic approach to turning individual findings into complete attack paths.

2026-04-301

privilege-escalation

YomMongkolphanna/SECURITY_BRAIN

Comprehensive privilege escalation methodology for Linux and Windows. Covers kernel exploits, SUID binaries, service misconfigurations, credential harvesting, and both local privilege escalation paths.

2026-04-301

recon-methodology

YomMongkolphanna/SECURITY_BRAIN

Comprehensive reconnaissance methodology covering OSINT, subdomain enumeration, technology fingerprinting, DNS reconnaissance, and attack surface mapping. Includes passive and active recon techniques with OPSEC considerations.

2026-04-301

sqli-testing

YomMongkolphanna/SECURITY_BRAIN

Comprehensive SQL injection testing methodology covering Union-based, Error-based, Blind (Boolean/Time-based), Stacked queries, and WAF bypass techniques. Includes database-specific payloads for MySQL, PostgreSQL, MSSQL, Oracle, SQLite, and NoSQL injection.

2026-04-301

ssrf-testing

YomMongkolphanna/SECURITY_BRAIN

Comprehensive Server-Side Request Forgery (SSRF) testing methodology covering basic SSRF, blind SSRF, DNS rebinding, cloud metadata exploitation, and gopher/redis attacks. Includes bypass techniques and automation.

2026-04-301

name	analyzing-cloud-storage-access-patterns
description	>-

Analyzing Cloud Storage Access Patterns

When to Use

When investigating security incidents that require analyzing cloud storage access patterns
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install boto3 requests
Query CloudTrail for S3 Data Events using AWS CLI or boto3.
Build access baselines: hourly request volume, per-user object counts, source IP history.
Detect anomalies:
- After-hours access (outside 8am-6pm local time)
- Bulk downloads: >100 GetObject calls from single principal in 1 hour
- New source IPs not seen in the prior 30 days
- ListBucket enumeration spikes (reconnaissance indicator)
Generate prioritized findings report.

python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json

Examples

CloudTrail S3 Data Event

{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}