AWS S3 Bucket Data Upload Exfiltration

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.