High Volume Connections to CodeArtifact or Artifactory

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.