AWS IAM Burst Enumeration Followed by Resource Deployment (T1087.004/T1578)

Renata Cardoso@rcardososec

•updated Jul 1, 2026•3•0•6

Detects anomalous activity where an identity performs a sequence of reconnaissance-related AWS API calls (e.g., listing roles, policies, or describing instances) followed shortly (within 10 minutes) by deployment actions like RunInstances or CreateCluster. This behavior is indicative of an attacker who has gained access to an identity and is surveying the environment before provisioning malicious infrastructure.