Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.
SkillScore45Maintained
Automatic
◆Security & AppSec pack
Last verified 7/27/2026
What it changes
Passed 10 of 21 test cases with the skill, and 2 of 21 without it.
Without skill9%
With skill45%
8 fixed2 passed either way12 still failing0 broke
Pass-rate lift
+36 pp
Tokens
-10%
Agent turns
0%
Response time
-37%
Model gemini-3.6-flashMeasured 7/27/2026v110 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
What's inside
The instructions your model reads when the skill loads.
SKILL.md40 lines3 filesincludes scripts
Analyzing Cloud Storage Access Patterns
When to Use
When investigating security incidents that require analyzing cloud storage access patterns
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Familiarity with cloud security concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Install dependencies: pip install boto3 requests
Query CloudTrail for S3 Data Events using AWS CLI or boto3.
Build access baselines: hourly request volume, per-user object counts, source IP history.
Detect anomalies:
After-hours access (outside 8am-6pm local time)
Bulk downloads: >100 GetObject calls from single principal in 1 hour