Cloud Account Access Revoked for Lockout Impact

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.