So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough wher

So many of the security monitoring tools that purport to detect things like that only work if the attacker is brainless. Modern networks are complex enough where a clever attacker (like a professional ransomware gang) can make malicious traffic look like any other traffic. Unless this was just a public S3 bucket, there was probably some lateral movement involved, and I'd say time/money would be better spent reducing that particular risk in the future.