AWS Cloud Enumeration After Credential Theft via Developer Tooling
Detects rapid, multi-type API enumeration (GetCallerIdentity, ListBuckets, DescribeInstances) performed by an IAM principal or AssumedRole that has no historical record of performing these actions. This pattern is indicative of potential credential theft, specifically from compromised developer tooling such as malicious MCP configurations or automated agents like Amazon Q, Claude Code, Cursor, or Windsurf.
Microsoft Sentinel (KQL)
