| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-10-06 |
| elastic |
AWS EC2 AMI Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Shared or Made Public |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| elastic |
AWS ECR Repository or Registry Policy Granted Public Access |
production |
2026-09-18 |
| elastic |
AWS RDS DB Snapshot Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Allow Public Access |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Container Access Level Modified |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Modification |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Data Transfer or Takeout Export Initiated |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Created |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Modified |
production |
2026-09-18 |
| elastic |
Potential Third-Party Cloud Storage Client Execution |
production |
2026-09-14 |
| splunk |
High Frequency Copy Of Files In Network Share |
production |
2026-08-05 |
| splunk |
AWS S3 Exfiltration Behavior Identified |
production |
2026-05-13 |
| splunk |
ASL AWS EC2 Snapshot Shared Externally |
production |
2026-05-13 |
| splunk |
AWS AMI Attribute Modification for Exfiltration |
production |
2026-05-13 |
| splunk |
AWS EC2 Snapshot Shared Externally |
production |
2026-05-13 |
| splunk |
AWS Exfiltration via Bucket Replication |
production |
2026-05-13 |
| splunk |
AWS Exfiltration via EC2 Snapshot |
production |
2026-05-13 |
| elastic |
Deprecated - AWS EC2 VM Export Failure |
deprecated |
2026-01-16 |
| elastic |
Deprecated - AWS EC2 Snapshot Activity |
deprecated |
2025-07-16 |
| sigma |
Github Fork Private Repositories Setting Enabled/Cleared |
test |
2024-07-29 |
| sigma |
Github Repository/Organization Transferred |
test |
2024-07-29 |
| sigma |
Data Exfiltration to Unsanctioned Apps |
test |
2022-10-09 |
| sigma |
AWS S3 Data Management Tampering |
test |
2022-10-09 |
| sigma |
AWS EC2 VM Export Failure |
test |
2022-10-05 |
| sigma |
AWS Snapshot Backup Exfiltration |
test |
2021-08-19 |