| elastic |
AWS IAM AdministratorAccess Policy Attached to User |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Role |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Group |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Granted Cluster Admin Policy |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
Unusual Country For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual City For an AWS Command |
production |
2026-09-18 |
| elastic |
Rare AWS Error Code |
production |
2026-09-18 |
| elastic |
Spike in AWS Error Messages |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS SSM Session Started to EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
AWS Access Token Used from Multiple Addresses |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
AWS Rare Source AS Organization Activity |
production |
2026-09-18 |
| elastic |
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN |
production |
2026-09-18 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
AWS S3 Static Site JavaScript File Uploaded |
production |
2026-09-18 |
| elastic |
AWS S3 Object Versioning Suspended |
production |
2026-09-18 |
| elastic |
AWS S3 Object Encryption Using External KMS Key |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket MFA Delete Disabled |
production |
2026-09-18 |
| elastic |
Excessive AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
Azure AKS Kubelet Proxy to Command Execution Endpoint |
production |
2026-09-18 |
| elastic |
Potential AWS S3 Bucket Ransomware Note Uploaded |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS Lambda Function High-Frequency Invocation by a Single Principal |
production |
2026-09-18 |
| elastic |
AWS KMS Imported Key Material Deleted |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |