Detection: Abnormally High Number Of Cloud Infrastructure API Calls

REMOVED DETECTION

This detection has been removed from the Splunk Threat Research content library and is no longer maintained or supported.

Reason: Detection is deprecated as these do not work with the latest Splunk AI Toolkit(5.7.0) and Python for Scientific Computing for Linux 64-bit(4.3.0).

Removed in version: 5.26.0

If you have any questions or concerns, please reach out to us at research@splunk.com.

Updated Date: 2026-05-13 ID: 0840ddf1-8c89-46ff-b730-c8d6722478c0 Author: David Dorsey, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects a spike in the number of API calls made to your cloud infrastructure by a user. It leverages cloud infrastructure logs and compares the current API call volume against a baseline probability density function to identify anomalies. This activity is significant because an unusual increase in API calls can indicate potential misuse or compromise of cloud resources. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or disruption of cloud services, posing a significant risk to the organization's cloud environment.

Search

 1
 2| tstats count as api_calls values(All_Changes.command) as command FROM datamodel=Change
 3  WHERE All_Changes.user!=unknown All_Changes.status=success
 4  BY All_Changes.user _time span=1h
 5
 6| `drop_dm_object_name("All_Changes")`
 7
 8| eval HourOfDay=strftime(_time, "%H")
 9
10| eval HourOfDay=floor(HourOfDay/4)*4
11
12| eval DayOfWeek=strftime(_time, "%w")
13
14| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
15
16| join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1]
17
18| where cardinality >=16
19
20| apply cloud_excessive_api_calls_v1 threshold=0.005
21
22| rename "IsOutlier(api_calls)" as isOutlier
23
24| where isOutlier=1
25
26| eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0)
27
28| where api_calls > expected_upper_threshold
29
30| eval distance_from_threshold = api_calls - expected_upper_threshold
31
32| table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold
33
34| `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`

Data Source

Name	Platform	Sourcetype	Source
AWS CloudTrail	AWS	`'aws:cloudtrail'`	`'aws_cloudtrail'`

Macros Used

Name	Value
drop_dm_object_name	``
abnormally_high_number_of_cloud_infrastructure_api_calls_filter	``

abnormally_high_number_of_cloud_infrastructure_api_calls_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1078.004	Cloud Accounts	Initial Access

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`N/A`
Earliest Time	`N/A`
Latest Time	`N/A`
Schedule Window	`N/A`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	No

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

You must be ingesting your cloud infrastructure logs. You also must run the baseline search Baseline Of Cloud Infrastructure API Calls Per User to create the probability density function.

Known False Positives

No false positives have been identified at this time.

Associated Analytic Story

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	Not Applicable	N/A	N/A	N/A
Unit	Not Applicable	N/A	`N/A`	`N/A`
Integration	Not Applicable	N/A	`N/A`	`N/A`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 12