SNS Publish/GetCallerIdentity via leaked assertible-zapier-sns-sender AWS creden

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•4

Detects multiple AWS API calls (Publish, GetCallerIdentity, ListTopics) originating from a specific IP address (23.234.84.102) associated with a Zapier SNS sender. This rule monitors for potentially unauthorized or anomalous API usage patterns by identifying repeated, successful, and non-error events from a known source that may indicate misuse or compromise of an integration account.