Data Transferred to Attacker Controlled AWS Account

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•2

This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.