AWS Excessive Successful Discovery Events

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•5•0•54

This rule detects an excessive number of successful AWS API calls related to discovery activities (e.g., Describe*, List*, Get*) originating from a single IAM user within a 5-minute timeframe. This behavior can indicate an adversary attempting to map out the cloud environment after gaining initial access.