-
Identifies when a user subscribes to an SNS topic using a new protocol type (ie. email, http, lambda, etc.). SNS allows users to subscribe to recieve topic messages across a broad range of protocols like email, sms, lambda functions, http endpoints, and applications. Adversaries may subscribe to an SNS topic to collect sensitive information or exfiltrate data via an external email address, cross-account AWS service or other means. This rule identifies a new protocol subscription method for a particular user.
Read More -
AWS SNS Topic Created by Rare User
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS SNS Resources: Investigation Guide Use Case: Threat Detection Tactic: Resource Development Tactic: Impact Noise: Low Performance: Normal Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS SNS ·Identifies when an SNS topic is created by a user who does not typically perform this action. Adversaries may create SNS topics to stage capabilities for data exfiltration or other malicious activities. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
Read More -
AWS SNS Topic Message Publish by Rare User
Sep 19, 2026 · Domain: Cloud Data Source: AWS Data Source: Amazon Web Services Data Source: AWS SNS Use Case: Threat Detection Resources: Investigation Guide Tactic: Lateral Movement Tactic: Exfiltration Tactic: Impact Noise: Low Performance: Fast Profile: Recommended Rule Type: New Terms Platform: AWS Data Source: AWS CloudTrail Service: AWS SNS ·Identifies when an SNS topic message is published by a rare user in AWS. Adversaries may publish messages to SNS topics for phishing campaigns, data exfiltration, or lateral movement within the AWS environment. SNS topics are used to send notifications and messages to subscribed endpoints such as applications, mobile devices or email addresses, making them a valuable target for adversaries to distribute malicious content or exfiltrate sensitive data. This is a New Terms rule that only flags when this behavior is observed for the first time by a user or role.
Read More