Обнаружение аномального доступа к облачным хранилищам

★ 8.4 · security

analyzing-cloud-storage-access-patterns is a Claude Code skill that detects abnormal access patterns in AWS S3, Google Cloud Storage, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. It builds statistical baselines covering hourly request volumes, per-user object counts, and source IP history, then flags deviations: bulk downloads exceeding 100 GetObject calls from a single principal within one hour, after-hours access outside 8 AM–6 PM, source IPs unseen in the prior 30 days, and ListBucket enumeration spikes as reconnaissance indicators. Running `python scripts/agent.py` with a bucket name and lookback window produces a prioritized JSON findings report. The skill is aimed at SOC analysts investigating suspected cloud data exfiltration or building detection rules aligned with MITRE ATT&CK techniques T1530 and T1619.