New storage bucket creation followed by bulk object staging
Detects the creation of a new AWS S3 bucket followed by a large volume of data uploads (more than 200 objects) within a 2-hour window. The detection focuses on activity attributed to a single identity with limited source IP diversity, which is highly indicative of scripted data staging and potential exfiltration preparation by an unauthorized actor.
Microsoft Sentinel (KQL)
