-
AWS Discovery API Calls via CLI from a Single Resource
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: AWS EC2 Data Source: AWS IAM Data Source: AWS S3 Data Source: AWS CloudTrail Data Source: AWS RDS Data Source: AWS Lambda Data Source: AWS STS Data Source: AWS KMS Data Source: AWS SES Data Source: AWS Cloudfront Data Source: AWS DynamoDB Data Source: AWS Elastic Load Balancing Data Source: AWS Organizations Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: ES|QL Platform: AWS Service: AWS IAM Service: AWS S3 Service: AWS EC2 Service: AWS Lambda Service: AWS RDS Service: AWS KMS Service: AWS STS Service: AWS SES Service: AWS DynamoDB ·Detects when a single AWS resource is running multiple read-only, discovery API calls in a 10-second window. This behavior could indicate an actor attempting to discover the AWS infrastructure using compromised credentials or a compromised instance. Adversaries may use this information to identify potential targets for further exploitation or to gain a better understanding of the target's infrastructure.
Read More -
AWS DynamoDB Scan by Unusual User
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS DynamoDB Resources: Investigation Guide Use Case: Threat Detection Tactic: Exfiltration Noise: Low Performance: Normal Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS DynamoDB ·Identifies when an AWS DynamoDB table is scanned by a user who does not typically perform this action. Adversaries may use the Scan operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the Scan action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
Read More -
AWS DynamoDB Table Exported to S3
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS DynamoDB Resources: Investigation Guide Use Case: Threat Detection Tactic: Exfiltration Noise: Low Performance: Normal Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS DynamoDB Service: AWS S3 ·Identifies when an AWS DynamoDB table is exported to S3. Adversaries may use the ExportTableToPointInTime operation to collect sensitive information or exfiltrate data from DynamoDB tables. This rule detects unusual user activity by monitoring for the ExportTableToPointInTime action in CloudTrail logs. This is a New Terms rule that only flags when this behavior is observed by a user or role for the first time.
Read More