S3 Bucket Exfiltration via CLI/Node

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•5

Detects potential S3 bucket exfiltration attempts originating from command-line interface (CLI) tools or Node.js applications. The rule specifically looks for network connections to AWS S3 regional endpoints (us-west or us-east) initiated by processes named 'node.exe', 'python.exe', or 'aws.exe'.