AWS EC2 High Number Of API Calls

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•1•0•44

This rule detects when an EC2 instance makes a high number of API calls within a 5-minute window. The rule specifically looks for API calls originating from an assumed role associated with an EC2 instance, identified by a user ID matching the pattern `/i-.*$/`. A high number is defined as more than 7 distinct product event types within the specified timeframe. This behavior can indicate reconnaissance or other malicious activity from a compromised instance.