AWS Successful Console Authentication From Multiple IPs
Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.
YARA-L

Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.

Already have an account?