AWS IAM User Account Enumeration via API

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects AWS IAM user account enumeration attempts via the ListUsers API call. It triggers when five or more HTTP requests to 'iam.amazonaws.com' containing 'ListUsers' in the URI are observed from a single source IP within a 30-second window. This behavior is indicative of an attacker trying to discover valid IAM user accounts.