| elastic |
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted |
production |
2026-09-25 |
| elastic |
AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt |
production |
2026-09-25 |
| elastic |
Ollama API Accessed from External Network |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
AWS Bedrock Guardrails Detected Multiple Violations by a Single User Over a Session |
production |
2026-09-25 |
| elastic |
Anthropic Magic Link Second Factor Disabled |
production |
2026-09-25 |
| elastic |
GenAI CLI Started with Unsafe Permission Bypass |
production |
2026-09-25 |
| elastic |
AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request |
production |
2026-09-25 |
| elastic |
Potential Abuse of Resources by High Token Count and Large Response Sizes |
production |
2026-09-25 |
| elastic |
Anthropic Organization IP Restriction Deleted |
production |
2026-09-25 |
| elastic |
Anthropic SSO Disabled or Connection Removed |
production |
2026-09-25 |
| elastic |
AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User |
production |
2026-09-25 |
| elastic |
AWS Bedrock High Risk Filesystem or Execution Tool Invocation |
production |
2026-09-25 |
| elastic |
Unusual High Denied Sensitive Information Policy Blocks Detected |
production |
2026-09-25 |
| elastic |
AWS Bedrock Invocations without Guardrails Detected by a Single User Over a Session |
production |
2026-09-25 |
| elastic |
AWS Bedrock Provisioned Model Throughput Tampering |
production |
2026-09-25 |
| elastic |
Claude Cowork VM Boot Image Tamper |
production |
2026-09-25 |
| elastic |
Unusual High Denied Topic Blocks Detected |
production |
2026-09-25 |
| elastic |
AWS Bedrock Detected Multiple Validation Exception Errors by a Single User |
production |
2026-09-25 |
| elastic |
AWS Bedrock Third-Party or External Knowledge Base Associated to Agent |
production |
2026-09-25 |
| elastic |
Anthropic Primary Owner Transferred |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
Anthropic MCP Server Created |
production |
2026-09-25 |
| elastic |
GenAI Process Performing Encoding/Chunking Prior to Network Activity |
production |
2026-09-25 |
| elastic |
GenAI Process Compiling or Generating Executables |
production |
2026-09-25 |
| elastic |
Connection to Common Large Language Model Endpoints |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage |
production |
2026-09-25 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-09-25 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| elastic |
GenAI Process Connection to Suspicious Top Level Domain |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage |
production |
2026-09-25 |
| elastic |
GenAI Process Connection to Unusual Domain |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage via Auditd |
production |
2026-09-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.shanetrainfitness .com domain |
rev 1 |
2026-09-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.shanetrainfitness .com domain |
rev 1 |
2026-09-25 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Potential ClickFix Command via Windows Run Dialog |
production |
2026-09-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.shanetrainfitness .com domain |
rev 1 |
2026-09-25 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.shanetrainfitness .com domain |
rev 1 |
2026-09-25 |
| elastic |
Mark-of-the-Web Removal by an Unusual Process |
production |
2026-09-25 |