| elastic |
Dylib Injection via Process Environment Variables |
production |
2026-09-18 |
| elastic |
AWS Cognito Unauthenticated Identity Pool Credentials Issued |
production |
2026-09-18 |
| elastic |
AWS S3 Credential File Retrieved from Bucket |
production |
2026-09-18 |
| elastic |
AWS IAM CompromisedKeyQuarantine Policy Attached to User |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key First Seen from Source IP |
production |
2026-09-18 |
| elastic |
AWS IAM User Addition to Group |
production |
2026-09-18 |
| elastic |
First Time Seen AWS Secret Value Accessed in Secrets Manager |
production |
2026-09-18 |
| elastic |
AWS Secrets Manager Rapid Secrets Retrieval |
production |
2026-09-18 |
| elastic |
AWS Systems Manager SecureString Parameter Request with Decryption Flag |
production |
2026-09-18 |
| elastic |
AWS Management Console Brute Force of Root User Identity |
production |
2026-09-18 |
| elastic |
AWS Root Console Login Password Spraying |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Deleted |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Evasion |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Suspended |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Management Events Disabled via PutEventSelectors |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Alarm Deletion |
production |
2026-09-18 |
| elastic |
AWS Config Resource Deletion |
production |
2026-09-18 |
| elastic |
AWS Configuration Recorder Stopped |
production |
2026-09-18 |
| elastic |
AWS Detective Graph Deleted |
production |
2026-09-18 |
| elastic |
AWS VPC Flow Logs Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
AWS EKS Control Plane Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detector Deletion |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detection Suppression |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS Potential Cryptomining via ECS Task Definition Deployment |
production |
2026-09-18 |
| elastic |
AWS EFS File System Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
AWS KMS Imported Key Material Deleted |
production |
2026-09-18 |
| elastic |
AWS Lambda Function High-Frequency Invocation by a Single Principal |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Deleted |
production |
2026-09-18 |