About

Imported from mukul975/anthropic-cybersecurity-skills (skills/analyzing-cloud-storage-access-patterns/SKILL.md) via skills.sh. Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-cloud-storage-access-patterns. Copyright stays with the author (Apache-2.0).

Analyzing Cloud Storage Access Patterns

Name: analyzing-cloud-storage-access-patterns
Author: mukul975

When to Use

When investigating security incidents that require analyzing cloud storage access patterns
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install boto3 requests
Query CloudTrail for S3 Data Events using AWS CLI or boto3.
Build access baselines: hourly request volume, per-user object counts, source IP history.
Detect anomalies:
- After-hours access (outside 8am-6pm local time)
- Bulk downloads: >100 GetObject calls from single principal in 1 hour
- New source IPs not seen in the prior 30 days
- ListBucket enumeration spikes (reconnaissance indicator)
Generate prioritized findings report.

python scripts/agent.py --bucket my-sensitive-data --hours-back 24 --output s3_access_report.json

Examples

CloudTrail S3 Data Event

{"eventName": "GetObject", "requestParameters": {"bucketName": "sensitive-data", "key": "financials/q4.xlsx"},
 "sourceIPAddress": "203.0.113.50", "userIdentity": {"arn": "arn:aws:iam::123456789012:user/analyst"}}

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-cloud-4a352f/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-analyzing-cloud-4a352f.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-analyzing-cloud-4a352f",
  "kind": "skill",
  "name": "analyzing-cloud-storage-access-patterns",
  "description": "Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "cloud-security",
      "aws-s3",
      "gcs",
      "azure-blob-storage",
      "cloudtrail",
      "data-access-anomaly",
      "exfiltration-detection",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours bulk downloads, new-IP access, and API-call spikes (e.g. GetObject) via statistical baselines and time-series anomaly detection. Use when investigating suspected cloud data exfiltration or building related detection rules."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/analyzing-cloud-storage-access-patterns/SKILL.md",
      "ref": "HEAD",
      "url": "https://www.skills.sh/mukul975/anthropic-cybersecurity-skills/analyzing-cloud-storage-access-patterns",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/analyzing-cloud-storage-access-patterns/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Analyzing Cloud Storage Access Patterns\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing cloud storage access patterns\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with cloud security concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing ac",
  "cost": {
    "context_tokens": 379
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-analyzing-cloud-4a352f/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.