Elastic Security Detection Rules

AWS Backup Resource Enumeration via Long-Term Access Key

Last updated a month ago on 2026-09-18
Created 2 months ago on 2026-08-24

About

Detects enumeration of AWS Backup resources using long-term IAM access keys (AKIA* prefix). AWS Backup protects EC2 instances, EBS volumes, RDS databases, DynamoDB tables, EFS file systems, and S3 buckets. An adversary who obtains long-term access keys may enumerate backup vaults, backup plans, and protected resources as a precursor to ransomware. Identifying which resources have recent backups (indicating high-value data) and what vault access policies can be modified to delete or corrupt the backups before encrypting the primary data.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesPlatform: AWSData Source: AWS CloudTrailService: AWS BackupRule Type: Custom Query (KQL)Tactic: DiscoveryLanguage: kuery
Severity
low
Risk Score
21
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ Cloud Service Discovery (T1526)(external, opens in a new tab or window)

False Positive Examples
Automated monitoring tools or compliance audit scripts using long-term IAM keys to inventory backup coverage will trigger this rule. Migrate automation to IAM roles with short-lived credentials. Long-term key usage for backup management is a security anti-pattern.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Query (Kibana Query Language)
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "backup.amazonaws.com"
    and event.action: (
        "ListBackupVaults" or
        "ListBackupJobs" or
        "ListBackupPlans" or
        "ListProtectedResources" or
        "ListRecoveryPointsByBackupVault" or
        "GetBackupPlan" or
        "GetBackupVaultAccessPolicy" or
        "DescribeBackupJob" or
        "DescribeRecoveryPoint"
    )
    and event.outcome: "success"
    and aws.cloudtrail.user_identity.access_key_id: AKIA*

Install detection rules in Elastic Security

Detect AWS Backup Resource Enumeration via Long-Term Access Key in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).