[AWS-LAMBDA] Possible Exfiltration Attempt (GetObject) [100/60sec]

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-LAMBDA] Possible Exfiltration Attempt (GetObject) [100/60sec]"; program:s3.amazonaws.com; content:"eventName
| 22 3a 20 22
| GetObject"; content:!"
| 22
| bytesTransferredOut
| 22 3a
| 0"; parse_src_ip:1; after:track by_src,count 100,seconds 60; threshold:type suppress, track by_src, count 5, seconds 86400; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; classtype:exfiltration; reference:url,https://unit42.paloaltonetworks.com/large-scale-cloud-extortion-operation/; sid:5015097; rev:1; metadata:mitre_tactic_id TA0010;)