| elastic |
Cloud Offensive Framework Execution |
production |
2026-10-08 |
| elastic |
AWS Control Plane Access by Suspicious Process |
production |
2026-10-06 |
| elastic |
AWS Service Quotas Multi-Region GetServiceQuota Requests |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Spike in Azure Activity Logs Failed Messages |
production |
2026-09-18 |
| elastic |
Rare Azure Activity Logs Event Failures |
production |
2026-09-18 |
| elastic |
Spike in GCP Audit Failed Messages |
production |
2026-09-18 |
| elastic |
Rare GCP Audit Failure Event Code |
production |
2026-09-18 |
| elastic |
Unusual Windows Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| elastic |
AWS EC2 Deprecated AMI Discovery |
production |
2026-09-18 |
| elastic |
AWS EC2 User Data Retrieval for EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls via CLI from a Single Resource |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls from VPN ASN for the First Time by Identity |
production |
2026-09-18 |
| elastic |
AWS Account Discovery By Rare User |
production |
2026-09-18 |
| elastic |
AWS S3 Rapid Bucket Posture API Calls from a Single Principal |
production |
2026-09-18 |
| elastic |
AWS SSM Inventory Reconnaissance by Rare User |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Enumeration or Brute Force |
production |
2026-09-18 |
| elastic |
Spike in AWS Error Messages |
production |
2026-09-18 |
| elastic |
Rare AWS Error Code |
production |
2026-09-18 |
| elastic |
Azure Storage Anonymous Blob Access to Unusual Resource |
production |
2026-09-18 |
| elastic |
Unusual Process Resolving AWS ECS Agent Communication Service Endpoint |
production |
2026-09-14 |
| splunk |
AWS IAM AccessDenied Discovery Events |
production |
2026-05-13 |
| splunk |
AWS IAM Assume Role Policy Brute Force |
production |
2026-05-13 |
| splunk |
AWS Bedrock High Number List Foundation Model Failures |
production |
2026-05-13 |
| splunk |
ASL AWS IAM AccessDenied Discovery Events |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Assume Role Policy Brute Force |
production |
2026-05-13 |
| sigma |
Potential Bucket Enumeration on AWS |
test |
2024-07-10 |