Query: s3_object_accessed_using_suspicious_user_agent

select
  tp_timestamp as timestamp,
  operation,
  bucket as resource,
  requester as actor,
  tp_source_ip as source_ip,
  tp_index as account_id,
  tp_id as source_id,
  http_status,
  error_code,
  *
from
  aws_s3_server_access_log
where
  operation in (
    'REST.GET.OBJECT',
    'REST.PUT.OBJECT',
    'REST.DELETE.OBJECT'
  )
  and (
    -- Command-line tools
    user_agent ilike '%curl%'
    or user_agent ilike '%wget%'
    or user_agent ilike '%python%'
    or user_agent ilike '%go-http%'
    or user_agent ilike '%ruby%'
    or user_agent ilike '%powershell%'
    or -- Known scanners and penetration testing tools
    user_agent ilike '%nuclei%'
    or user_agent ilike '%nmap%'
    or user_agent ilike '%burpsuite%'
    or user_agent ilike '%sqlmap%'
    or user_agent ilike '%nikto%'
    or user_agent ilike '%hydra%'
    or user_agent ilike '%metasploit%'
    or user_agent ilike '%gobuster%'
    or user_agent ilike '%dirbuster%'
    or -- Suspicious bots and crawlers
    user_agent ilike '%zgrab%'
    or user_agent ilike '%masscan%'
    or user_agent ilike '%googlebot%'
    or user_agent ilike '%baiduspider%'
    or -- Generic indicators
    user_agent ilike '%scanner%'
    or user_agent ilike '%exploit%'
    or user_agent ilike '%attack%'
    or user_agent is null
  )
order by
  tp_timestamp desc;