Abnormally High Number Of Cloud Infrastructure API Calls

SPLUNK detection rule by David Dorsey, Splunk · Apache-2.0

The following analytic detects a spike in the number of API calls made to your cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.

name: Abnormally High Number Of Cloud Infrastructure API Calls
id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
version: 12
creation_date: '2020-10-27'
modification_date: '2026-05-13'
author: David Dorsey, Splunk
status: removed
type: Anomaly
description: The following analytic detects a spike in the number of API calls made to your cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.
data_source:
    - AWS CloudTrail
search: |-
    | tstats count as api_calls values(All_Changes.command) as command FROM datamodel=Change
      WHERE All_Changes.user!=unknown All_Changes.status=success
      BY All_Changes.user _time span=1h
    | `drop_dm_object_name("All_Changes")`
    | eval HourOfDay=strftime(_time, "%H")
    | eval HourOfDay=floor(HourOfDay/4)*4
    | eval DayOfWeek=strftime(_time, "%w")
    | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
    | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1]
    | where cardinality >=16
    | apply cloud_excessive_api_calls_v1 threshold=0.005
    | rename "IsOutlier(api_calls)" as isOutlier
    | where isOutlier=1
    | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
    | where api_calls > expected_upper_threshold
    | eval distance_from_threshold = api_calls - expected_upper_threshold
    | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold
    | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
known_false_positives: No false positives have been identified at this time.
references: []
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
rba:
    message: user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
    risk_objects:
        - field: user
          type: user
          score: 20
    threat_objects: []
tags:
    analytic_story:
        - Suspicious Cloud User Activities
        - Compromised User Account
        - Scattered Lapsus$ Hunters
    asset_type: AWS Instance
    mitre_attack_id:
        - T1078.004
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: network
    manual_test: This search needs the baseline `Baseline Of Cloud Infrastructure API Calls Per User` to be run first.
tests:
    - name: True Positive Test
      attack_data:
          - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
            sourcetype: aws:cloudtrail
            source: aws_cloudtrail
deprecation_info:
    reason: Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).
    removed_in_version: 5.26.0
    replacement_content: []

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8f7fd885-d92e-41bf-b5ae-b76f4e7f7e0a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion