Most Critical Detection 2026 – LLM-Based Autonomous Mass Credential Harvesting Campaign
Detects high-volume, automated attempts to validate AWS credentials (access keys) from a single source IP address within a short time window. This pattern, characterized by a large number of distinct access keys being tested against identity-confirming API calls (e.g., GetCallerIdentity, AssumeRole) with a mix of success and failure, is indicative of automated credential harvesting or reconnaissance campaigns.
Microsoft Sentinel (KQL)
