GetObject

AWS

GetObject

service: AWS - S3

tactics:

Collection Exfiltration

techniques:

T1530 T1537

tags:

AWS S3

Event

Retrieves (downloads) an object from an S3 bucket; logged in CloudTrail only when S3 data events are enabled.

Security Context

Accessing cloud storage objects can expose sensitive data including backups, configuration files, application data, and customer information.
Transferring data to external cloud accounts or regions can bypass network-based data loss prevention controls and exfiltrate large volumes of data.

Log Source

CloudTrail

Sample Event

Adversarial — exfiltration. Draco — using federation-token credentials he obtained earlier (see aws-getfederationtoken) — downloads a NIFFLER PII parquet file (pii/2026-04/customer-pii-export.parquet) from fantasticlogs-niffler-archive. Cross-region read (us-west-2 source bucket, caller in us-east-1) and adversary IP make this a high-fidelity exfil signal. T1530 + T1537.

{
  "eventVersion": "1.09",
  "userIdentity": {
    "type": "FederatedUser",
    "principalId": "555123456789:draco-fed",
    "arn": "arn:aws:sts::555123456789:federated-user/draco-fed",
    "accountId": "555123456789",
    "accessKeyId": "ASIADRAC0FED0SESS00666",
    "sessionContext": {
      "sessionIssuer": {
        "type": "IAMUser",
        "principalId": "AIDADRAC0MALF0YBADGY",
        "arn": "arn:aws:iam::555123456789:user/draco",
        "accountId": "555123456789",
        "userName": "draco"
      },
      "attributes": {
        "creationDate": "2026-04-15T21:21:38Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2026-04-15T21:28:54Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "GetObject",
  "awsRegion": "us-west-2",
  "sourceIPAddress": "203.0.113.66",
  "userAgent": "[aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6]",
  "requestParameters": {
    "bucketName": "fantasticlogs-niffler-archive",
    "Host": "fantasticlogs-niffler-archive.s3.us-west-2.amazonaws.com",
    "key": "pii/2026-04/customer-pii-export.parquet"
  },
  "responseElements": null,
  "additionalEventData": {
    "SignatureVersion": "SigV4",
    "CipherSuite": "TLS_AES_128_GCM_SHA256",
    "bytesTransferredIn": 0,
    "AuthenticationMethod": "AuthHeader",
    "x-amz-id-2": "EXAMPLEEXAMPLEEXAMPLEEXAMPLE/EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE",
    "bytesTransferredOut": 1834521088
  },
  "requestID": "90000000-0000-4000-8000-000100111110",
  "eventID": "90000000-0000-4000-8000-000100111111",
  "readOnly": true,
  "resources": [
    {
      "type": "AWS::S3::Object",
      "ARN": "arn:aws:s3:::fantasticlogs-niffler-archive/pii/2026-04/customer-pii-export.parquet"
    },
    {
      "accountId": "555123456789",
      "type": "AWS::S3::Bucket",
      "ARN": "arn:aws:s3:::fantasticlogs-niffler-archive"
    }
  ],
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "recipientAccountId": "555123456789",
  "eventCategory": "Data",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "fantasticlogs-niffler-archive.s3.us-west-2.amazonaws.com"
  }
}

MITRE ATT&CK Mapping

Tactics: Collection Exfiltration

Techniques:

T1530 — Data from Cloud Storage — Adversaries may access data from cloud storage.
T1537 — Transfer Data to Cloud Account — Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.

GetObject

Event

Security Context

Log Source

Sample Event

MITRE ATT&CK Mapping

Related Events