---
name: Analyzing Cloud Storage Access Patterns
slug: analyzing-cloud-storage-access-patterns
category: Data
description: Analyzing Cloud Storage Access Patterns detects abnormal access in AWS S3, GCS, and Azure Blob Storage via audit logs for after-hours bulk downloads, new-IP access, and API-call spikes. Use when investigating suspected cloud data exfiltration or building detection rules
github: "https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-cloud-storage-access-patterns"
language: Python
stars: 27758
forks: 3369
install: "npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-cloud-storage-access-patterns ~/.claude/skills/analyzing-cloud-storage-access-patterns"
installs_to: ~/.claude/skills/analyzing-cloud-storage-access-patterns
source_path: skills/analyzing-cloud-storage-access-patterns/SKILL.md
collection_size: 25
category_size: 668
collection_url: "https://dirskills.com/collections/mukul975/Anthropic-Cybersecurity-Skills"
added: 2026-08-14T07:11:58.265Z
last_synced: 2026-08-14T07:11:58.265Z
canonical_url: "https://dirskills.com/skills/analyzing-cloud-storage-access-patterns"
---

# Analyzing Cloud Storage Access Patterns

Analyzing Cloud Storage Access Patterns detects abnormal access in AWS S3, GCS, and Azure Blob Storage via audit logs for after-hours bulk downloads, new-IP access, and API-call spikes. Use when investigating suspected cloud data exfiltration or building detection rules

**Install:**

```bash
npx degit https://github.com/mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/analyzing-cloud-storage-access-patterns ~/.claude/skills/analyzing-cloud-storage-access-patterns
```

## README

# Analyzing Cloud Storage Access Patterns


## When to Use

- When investigating security incidents that require analyzing cloud storage access patterns
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Familiarity with cloud security concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities

## Instructions

1. Install dependencies: `pip install boto3 requests`
2. Query CloudTrail for S3 Data Events using AWS CLI or boto3.
3. Build access baselines: hourly request volume, per-user object counts, source IP history.
4. Detect anomalies:
   - After-hours access (outside 8am-6pm local time)
   - Bulk downloads: >100 GetObject calls from single principal in 1 hour
   - New source IPs not seen in the prior 30 days
   - ListBucket enumeration spikes (reconnaissance indicator)
5. Generate prioritized findings report.

```bash
python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json
```

## Examples

### CloudTrail S3 Data Event
```json
{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}
```