From 9c7abde63511cd0b4f66ea522855fa05f4c6f6f3 Mon Sep 17 00:00:00 2001
From: lostman <48743459+laostmann@users.noreply.github.com>
Date: Wed, 1 Apr 2026 17:33:22 -0400
Subject: [PATCH 1/2] New rule: AWS CloudTrail General Discovery and
 Reconnaissance API Calls

---
 .../aws_cloudtrail_discovery_api_calls.yml    | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml

diff --git a/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml b/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml
new file mode 100644
index 00000000000..9d257fe832c
--- /dev/null
+++ b/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml
@@ -0,0 +1,66 @@
+title: AWS CloudTrail General Discovery and Reconnaissance API Calls
+id: 52a27427-d366-4152-b728-f0157aa2ba64
+status: experimental
+description: |
+    Detects a high volume of AWS discovery/reconnaissance API calls from a single
+    user within a short timeframe. Threat actors leverage these actions after gaining
+    unauthorized access via compromised credentials or privilege escalation to enumerate
+    storage, networking, compute, and database resources within an AWS environment.
+references:
+    - https://attack.mitre.org/techniques/T1526/
+    - https://docs.aws.amazon.com/cloudtrail/latest/userguide/cloudtrail-event-reference.html
+author: Lars Ostmann
+date: 2026/04/01
+tags:
+    - attack.discovery
+    - attack.t1526
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventName:
+            - 'ListRoles'
+            - 'ListIdentities'
+            - 'ListAccountAliases'
+            - 'GetUser'
+            - 'GetAccount'
+            - 'DescribeHosts'
+            - 'DescribeInstanceTypes'
+            - 'DescribeInstanceStatus'
+            - 'DescribeLaunchTemplates'
+            - 'DescribeTags'
+            - 'DescribeSnapshots'
+            - 'DescribeVolumes'
+            - 'DescribeVolumeStatus'
+            - 'ListBuckets'
+            - 'GetBucketLocation'
+            - 'DescribeRouteTables'
+            - 'DescribeLoadBalancers'
+            - 'DescribeVpcs'
+            - 'DescribeSubnets'
+            - 'DescribeInternetGateways'
+            - 'DescribeSecurityGroups'
+            - 'DescribeAvailabilityZones'
+            - 'GetHostedZoneCount'
+            - 'ListDomains'
+            - 'DescribeDBInstances'
+            - 'DescribeDBSnapshots'
+            - 'DescribeDBSubnetGroups'
+            - 'DescribeDBEngineVersions'
+            - 'DescribeDBClusters'
+            - 'DescribeGlobalClusters'
+            - 'DescribeAlarms'
+            - 'DescribeAlarmsForMetric'
+            - 'DescribeEvents'
+            - 'GetCostAndUsage'
+            - 'GetCostForecast'
+            - 'GetSendQuota'
+            - 'ListApplications'
+    condition: selection | count(eventName) by userIdentity.arn > 6
+timeframe: 5m
+falsepositives:
+    - Legitimate cloud security posture management tools (e.g. Wiz, CrowdStrike CSPM, Stacklet)
+    - Authorized cloud infrastructure automation and configuration management roles
+    - Security team-initiated cloud environment assessments
+level: low
\ No newline at end of file

From 30702a385df197b4dabb6d5d69e8a24d95854dcc Mon Sep 17 00:00:00 2001
From: lostman <48743459+laostmann@users.noreply.github.com>
Date: Tue, 14 Apr 2026 11:14:52 -0400
Subject: [PATCH 2/2] Update author name

---
 .../cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml b/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml
index 9d257fe832c..7eba7d04de0 100644
--- a/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml
+++ b/rules/cloud/aws/cloudtrail/aws_cloudtrail_discovery_api_calls.yml
@@ -9,7 +9,7 @@ description: |
 references:
     - https://attack.mitre.org/techniques/T1526/
     - https://docs.aws.amazon.com/cloudtrail/latest/userguide/cloudtrail-event-reference.html
-author: Lars Ostmann
+author: uniqu3-us3r
 date: 2026/04/01
 tags:
     - attack.discovery