AWS CLI API Command Execution Detected

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.