| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Allow Public Access |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS RDS DB Snapshot Shared with Another Account |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
AWS ECR Repository or Registry Policy Granted Public Access |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Shared or Made Public |
production |
2026-09-18 |
| elastic |
AWS EC2 AMI Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
GKE Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
GKE Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` Execution by Rare User |
production |
2026-09-18 |
| elastic |
AWS SSM Command Document Created by Rare User |
production |
2026-09-18 |
| elastic |
First Time AWS CloudFormation Stack Creation |
production |
2026-09-18 |
| elastic |
AWS Lambda Layer Shared Externally |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Invoked from an Unusual Source ASN |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Invoked Cross-Account |
production |
2026-09-18 |
| elastic |
AWS Lambda Layer Added to Existing Function |
production |
2026-09-18 |
| elastic |
AWS EC2 Stop, Start, and User Data Modification Correlation |
production |
2026-09-18 |
| elastic |
AWS CloudShell Environment Created |
production |
2026-09-18 |
| elastic |
AWS Batch Job Submitted with Container Override by Unusual Identity |
production |
2026-09-18 |
| elastic |
AWS SSM Inventory Reconnaissance by Rare User |
production |
2026-09-18 |
| elastic |
AWS SES Enumeration via Long-Term Access Key |
production |
2026-09-18 |
| elastic |
AWS Service Quotas Multi-Region GetServiceQuota Requests |
production |
2026-09-18 |
| elastic |
AWS S3 Rapid Bucket Posture API Calls from a Single Principal |
production |
2026-09-18 |
| elastic |
AWS Account Discovery By Rare User |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detection Suppression |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detector Deletion |
production |
2026-09-18 |
| elastic |
AWS EKS Control Plane Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity |
production |
2026-09-18 |
| elastic |
AWS VPC Flow Logs Deletion |
production |
2026-09-18 |