| elastic |
AWS EC2 Network Access Control List Creation |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS SSM Session Started to EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-09-18 |
| elastic |
Active Directory Forced Authentication from Linux Host - SMB Named Pipes |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
AWS S3 Static Site JavaScript File Uploaded |
production |
2026-09-18 |
| elastic |
AWS S3 Object Versioning Suspended |
production |
2026-09-18 |
| elastic |
AWS S3 Object Encryption Using External KMS Key |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket MFA Delete Disabled |
production |
2026-09-18 |
| elastic |
Excessive AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS EFS File System Deleted |
production |
2026-09-18 |
| elastic |
AWS Potential Cryptomining via ECS Task Definition Deployment |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS EC2 Encryption Disabled |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Updated |
production |
2026-09-18 |
| elastic |
AWS Backup Vault Deleted or Vault Lock Removed |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Enumeration or Brute Force |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
AWS Account Closed |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` Execution by Rare User |
production |
2026-09-18 |
| elastic |
AWS SSM Command Document Created by Rare User |
production |
2026-09-18 |
| elastic |
First Time AWS CloudFormation Stack Creation |
production |
2026-09-18 |
| elastic |
AWS Lambda Layer Shared Externally |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Invoked from an Unusual Source ASN |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Invoked Cross-Account |
production |
2026-09-18 |
| elastic |
AWS Lambda Layer Added to Existing Function |
production |
2026-09-18 |