Potential AWS S3 Data Exfiltration from External IP

Lacey Cochrane@NullVectorX

•updated Jan 18, 2026•11•1•124

This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.