AWS cross-account AssumeRole followed by S3 read burst (Qubole-style, tuned)

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•2

Detects cross-account AWS AssumeRole activity from an external account followed by extensive Amazon S3 enumeration and read (GetObject) operations within a 12-hour window, potentially indicating unauthorized data access or exfiltration.