Sagan unknown stable other

[AWS] S3 Enumeration (Multiple ListObectsv2 Events)

[AWS] S3 Enumeration (Multiple ListObectsv2 Events)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS] S3 Enumeration (Multiple ListObectsv2 Events)"; program:s3.amazonaws.com; json_content:".eventName","ListObjectsV2"; after:track by_username,count 10, seconds 60; json_map:"src_ip",".sourceIPAddress"; json_map:"username",".userIdentity.sessionContext.se"; classtype:user-activity; sid:5017059; rev:1; metadata: createdOn 2025_05_09, updatedOn 2025_07_30;)

Field Validations

Loading…

Comments (0)

Loading comments...