| elastic |
AWS STS Role Assumption by User |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by Service |
production |
2026-09-18 |
| elastic |
AWS KMS Key Policy Updated via PutKeyPolicy |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Updated |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
AWS IAM Permissions Boundary Modified or Removed |
production |
2026-09-18 |
| elastic |
AWS IAM Inline Policy Added to a Group |
production |
2026-09-18 |
| elastic |
File with High Entropy Created by Web Server |
production |
2026-09-18 |
| elastic |
AWS IAM Customer Managed Policy Version Created or Default Version Set |
production |
2026-09-18 |
| elastic |
AWS IAM Customer-Managed Policy Attached to Role by Rare User |
production |
2026-09-18 |
| elastic |
File with Suspicious Double Extension Created by Web Server |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to User |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Role |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Group |
production |
2026-09-18 |
| elastic |
User or Group Creation/Modification |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Granted Cluster Admin Policy |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
Finder Sync Plugin Registered and Enabled |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
Linux User Account Credential Modification |
production |
2026-09-18 |
| elastic |
Unusual Country For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual City For an AWS Command |
production |
2026-09-18 |
| elastic |
Rare AWS Error Code |
production |
2026-09-18 |
| elastic |
Spike in AWS Error Messages |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
Authentication via Unusual PAM Grantor |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
AWS Access Token Used from Multiple Addresses |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |