Suspicious High-Volume CloudWatch Logs Read Operations

This threat brief focuses on the detection of potential reconnaissance or data exfiltration activities targeting Amazon CloudWatch Logs. Adversaries often target these logs to gain visibility into infrastructure, application logic, and security telemetry. The identified behavior involves an AWS principal or role initiating an excessive number of read operations (more than 500 events) within a five-minute window. Observed API calls include DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, and GetQueryResults. While legitimate administrative or automated tasks (such as SIEM pipelines or backup tools) may generate similar traffic, unauthorized spikes warrant investigation to rule out adversary-led discovery or collection of sensitive operational data.

Impact

Successful exploitation allows unauthorized entities to gain deep insights into an organization's cloud environment, potentially exposing credentials, secrets, or internal system architecture stored within log files. This can facilitate further lateral movement or data exfiltration efforts.

Recommendation

Detection engineering teams should implement monitoring for high-frequency CloudWatch API usage to identify potential data discovery.

• Deploy the provided detection logic to AWS CloudTrail telemetry to identify principals performing >500 read operations in 5 minutes.
• Establish an allowlist for known-good automation service roles, incident response tooling, and SIEM ingestion service accounts to reduce false positives.
• Audit principals identified by the detection to confirm they are associated with authorized infrastructure tasks rather than anomalous or malicious origins.