| elastic |
AWS IAM SAML Provider Updated |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
AWS IAM Permissions Boundary Modified or Removed |
production |
2026-09-18 |
| elastic |
AWS IAM Inline Policy Added to a Group |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance Made Public |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Password Modified |
production |
2026-09-18 |
| elastic |
AWS Organizations Delegated Administrator Registered |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
AWS Lambda Function URL Created with Public Access |
production |
2026-09-18 |
| elastic |
AWS IAM Group Creation |
production |
2026-09-18 |
| elastic |
AWS IAM Create User via Assumed Role on EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Added for Root |
production |
2026-09-18 |
| elastic |
AWS IAM API Calls via Temporary Session Tokens |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Modified |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Created Then Deleted by Same Identity |
production |
2026-09-18 |
| elastic |
AWS EC2 Security Group Configuration Change |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS SSM Session Started to EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
AWS Access Token Used from Multiple Addresses |
production |
2026-09-18 |
| elastic |
GKE Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
AWS Rare Source AS Organization Activity |
production |
2026-09-18 |
| elastic |
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN |
production |
2026-09-18 |
| elastic |
Potential AWS S3 Bucket Ransomware Note Uploaded |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS Lambda Function High-Frequency Invocation by a Single Principal |
production |
2026-09-18 |
| elastic |
AWS KMS Imported Key Material Deleted |
production |
2026-09-18 |
| elastic |
AWS EC2 Encryption Disabled |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |