This rule detects potential ransomware reconnaissance by identifying the use of long-term IAM access keys (AKIA* prefix) to enumerate AWS Backup resources via AWS CloudTrail events. Attacker-provided keys may be exfiltrated from source code or CI/CD pipelines and used to discover backup vaults, backup plans, and protected resources (e.g., ListBackupVaults, ListBackupPlans, ListProtectedResources, DescribeRecoveryPoint). Enumerating backups reveals high-value recovery points and vault policies that could be modified to delete or corrupt backups before encrypting primary data. The rule flags successful CloudTrail events for AWS Backup actions when the user_identity.access_key_id matches AKIA*, indicating possible misuse of long-term credentials for discovery (MITRE ATT&CK T1526 Cloud Service Discovery / TA0007 Discovery). It requires that the AWS integration is ingesting management events (logs-aws.cloudtrail-*) and that the event outcome is 'success'. If triggered, investigators should map the IAM user and source IP to expected assets, verify authorization for backup management access, and review related backup operations. Remediation includes deactivating the long-term key, enabling Vault Lock (WORM) on critical vaults, auditing and tightening backup access policies, and enabling audit reports to detect future abuse.