| elastic |
Attempt to Enable the Root Account |
production |
2026-09-18 |
| elastic |
Insecure AWS EC2 VPC Security Group Ingress Rule Added |
production |
2026-09-18 |
| elastic |
AWS WAF Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS WAF Rule or Rule Group Deletion |
production |
2026-09-18 |
| elastic |
AWS Backup Resource Enumeration via Long-Term Access Key |
production |
2026-09-18 |
| elastic |
AWS EC2 Deprecated AMI Discovery |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Emond Rules Creation or Modification |
production |
2026-09-18 |
| elastic |
Persistence via Docker Shortcut Modification |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Suspicious pbpaste High Volume Activity |
production |
2026-09-18 |
| elastic |
Dumping of Keychain Content via Security Command |
production |
2026-09-18 |
| elastic |
AWS EC2 User Data Retrieval for EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls via CLI from a Single Resource |
production |
2026-09-18 |
| elastic |
AWS STS GetCallerIdentity API Called for the First Time |
production |
2026-09-18 |
| elastic |
AWS EC2 Role GetCallerIdentity from New Source AS Organization |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls from VPN ASN for the First Time by Identity |
production |
2026-09-18 |
| elastic |
Dumping Account Hashes via Built-In Commands |
production |
2026-09-18 |
| elastic |
Keychain CommandLine Interaction via Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Suspicious Outbound Network Connection via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS Potential Cryptomining via ECS Task Definition Deployment |
production |
2026-09-18 |
| elastic |
AWS EFS File System Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
AWS KMS Imported Key Material Deleted |
production |
2026-09-18 |
| elastic |
AWS Lambda Function High-Frequency Invocation by a Single Principal |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |
| elastic |
Potential AWS S3 Bucket Ransomware Note Uploaded |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |