AWS EC2 Instance and AMI Discovery for VM Enum

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects HTTP requests to the AWS EC2 service (ec2.amazonaws.com) that specifically attempt to enumerate Amazon Machine Images (AMIs) using the 'DescribeImages' API call. This activity could indicate an attacker performing reconnaissance to understand the available virtual machine images within an AWS environment.