LoFP
/
t1580
t1580
Title
Tags
administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
t1580
aws
sigma
it is possible to start this detection will need to be tuned by source ip or user. in addition, change the count values to an upper threshold to restrict false positives.
t1580
aws account
splunk
known or internal account ids or automation
T1530
t1580
T1657
aws
elastic