AWS EC2 Instance Inventory Enumerated via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to enumerate AWS EC2 instances via the DescribeInstances API call. It specifically looks for HTTP traffic destined for 'ec2.amazonaws.com' with 'DescribeInstances' in the URI, indicating a potential reconnaissance activity against AWS EC2 infrastructure.