Cloud Audit Logs Queried for Attacker Activity Discovery

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects attempts to query AWS CloudTrail logs for activity discovery. Specifically, it looks for HTTP traffic to 'cloudtrail.amazonaws.com' with the URI containing 'LookupEvents'. This activity could indicate an attacker attempting to understand the environment or their own actions.