AWS Post-Compromise Discovery Activity

Bryant Smith@flowstate

•updated Mar 12, 2026•3•0•114

Detects when a successful AWS Console Login is immediately followed by discovery actions from the same user and IP address. This pattern is indicative of an attacker performing reconnaissance after gaining initial access, as seen in recent AWS phishing campaigns.