AWS S3 Large Volume Data Download

nomit vyas@xoxo

•updated Aug 12, 2025•2•1•98

Detects a single S3 object download event where the volume of data transferred exceeds a defined threshold. This can be an indicator of bulk data exfiltration. Attackers may download large archives or databases from compromised S3 buckets.