Leaked AWS secret used for GetCallerIdentity/ListTopics recon from known IP

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•0

This rule detects potential cloud service enumeration activity originating from a specific, potentially malicious IP address (23.234.84.102). It flags instances where this source IP performs specific API calls ('GetCallerIdentity' and 'ListTopics') without expected user-agent strings typical of legitimate AWS service traffic.