AWS IAM Group Enumeration via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects attempts to enumerate AWS IAM groups via the 'ListGroups' API call. It specifically looks for HTTP traffic directed to 'iam.amazonaws.com' with 'ListGroups' in the URI, indicating a potential reconnaissance activity against AWS Identity and Access Management.