AWS S3 Object List Enumerated for Data Discovery

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.