| name | detect-aws-enumeration-burst |
| description | Detect short-window bursts of high-signal AWS discovery APIs from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1526 (Cloud Service Discovery) when one principal rapidly calls a narrow allow-list of CloudTrail discovery APIs across IAM, EC2, S3, KMS, Lambda, EKS, CloudTrail, and Organizations. Use when the user mentions "AWS discovery burst", "CloudTrail enumeration spree", "rapid Describe/List calls", or "T1526 via CloudTrail". Do NOT use as a generic anomaly detector for every read API, to claim all AWS discovery paths, or to infer exfiltration from read-only control-plane calls. |
| purpose | Detect short-window bursts of high-signal AWS discovery APIs from OCSF 1.8 API Activity records emitted by ingest-cloudtrail-ocsf. Emits an OCSF 1.8 Detection Finding (class 2004) tagged with MITRE ATT&CK T1526 (Cloud... |
| capability | detect |
| persistence | none |
| telemetry | stderr_jsonl |
| privilege_escalation | none |
| license | Apache-2.0 |
| approval_model | none |
| execution_modes | jit, ci, mcp, persistent |
| side_effects | none |
| input_formats | ocsf |
| output_formats | native, ocsf |
| concurrency_safety | stateless |
| compatibility | Requires Python 3.11+. Read-only — consumes OCSF 1.8 API Activity records from stdin/file and emits OCSF 1.8 Detection Finding 2004 to stdout. No AWS SDK; pairs with ingest-cloudtrail-ocsf upstream. |
| metadata | {"author":"msaad00","homepage":"https://github.com/msaad00/cloud-ai-security-skills","source":"https://github.com/msaad00/cloud-ai-security-skills/tree/main/skills/detection/detect-aws-enumeration-burst","version":"0.1.0","frameworks":["OCSF 1.8","MITRE ATT&CK v14"],"cloud":"aws","capability":"read-only"} |
detect-aws-enumeration-burst
Streaming detector for rapid AWS discovery bursts in CloudTrail. This is the
first shipped AWS cloud-discovery slice under the ATT&CK roadmap, and it stays
intentionally narrow so the repo does not over-claim generic discovery coverage.
Use when
- You stream CloudTrail through
ingest-cloudtrail-ocsf and want near-real-time findings on suspicious enumeration bursts
- You want a deterministic, read-only AWS discovery detector aligned to ATT&CK
T1526
- You need a narrow follow-on slice after the shipped AWS IAM-user access-key and login-profile persistence detectors
Do NOT use
- As a generic anomaly detector for every
Describe*, Get*, or List* call in AWS
- To infer exfiltration or data access; use a dedicated egress or data-transfer detector
- To claim every AWS discovery path is covered; this first slice is only a curated allow-list of high-signal control-plane APIs
Rule
A finding fires when one AWS principal, within a rolling five-minute window:
- emits at least
6 successful CloudTrail events from ingest-cloudtrail-ocsf
- across at least
5 distinct allow-listed discovery API calls
- against the same account / region / principal key
Today the allow-list covers high-signal AWS discovery APIs such as:
- IAM:
ListUsers, ListRoles, ListPolicies, GetAccountAuthorizationDetails
- EC2:
DescribeInstances, DescribeSecurityGroups, DescribeSubnets, DescribeVpcs
- S3:
ListBuckets
- Organizations:
DescribeOrganization, ListAccounts
- KMS:
ListKeys
- Lambda:
ListFunctions
- EKS:
ListClusters
- CloudTrail:
DescribeTrails
OCSF output
OCSF 1.8 Detection Finding (class 2004), severity MEDIUM (severity_id=3), with:
finding_info.attacks[].tactic_uid = TA0007 (Discovery)finding_info.attacks[].technique_uid = T1526 (Cloud Service Discovery)observables[] including actor, account, region, source IP, total event count, distinct API count, and the concrete API set seen in the burst
The native projection (--output-format native) keeps the same burst summary in
a flatter shape.
Run
python skills/ingestion/ingest-cloudtrail-ocsf/src/ingest.py raw.jsonl \
| python skills/detection/detect-aws-enumeration-burst/src/detect.py \
> findings.ocsf.jsonl
python skills/detection/detect-aws-enumeration-burst/src/detect.py findings-input.jsonl --output-format native
See also
