AWS Console Login for Cloud Resource Discovery

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects multiple AWS console login attempts from a single source IP address within a short timeframe, specifically looking for access to the 'home' URI on 'console.aws.amazon.com'. This behavior could indicate an attacker attempting to discover cloud resources after gaining initial access to an AWS account.