| elastic |
AWS Backup Vault Deleted or Vault Lock Removed |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Enumeration or Brute Force |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
AWS Account Closed |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
AWS EKS Control Plane Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detector Deletion |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detection Suppression |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Threat Intelligence Set Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Account Password Policy Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity |
production |
2026-09-18 |
| elastic |
AWS Attempt to Leave Organization |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance Restored |
production |
2026-09-18 |
| elastic |
AWS Route 53 Resolver Query Log Configuration Deleted |
production |
2026-09-18 |
| elastic |
AWS SNS Rare Protocol Subscription by User |
production |
2026-09-18 |
| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Allow Public Access |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS RDS DB Snapshot Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Configuration Deletion |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Expiration Lifecycle Configuration Added |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Server Access Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS Security Hub Disabled |
production |
2026-09-18 |
| elastic |
AWS SQS Queue Purge |
production |
2026-09-18 |
| elastic |
AWS First Occurrence of STS GetFederationToken Request by User |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
AWS ECR Repository or Registry Policy Granted Public Access |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Shared or Made Public |
production |
2026-09-18 |
| elastic |
AWS EC2 AMI Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
Insecure AWS EC2 VPC Security Group Ingress Rule Added |
production |
2026-09-18 |
| elastic |
AWS WAF Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS WAF Rule or Rule Group Deletion |
production |
2026-09-18 |
| elastic |
AWS Backup Resource Enumeration via Long-Term Access Key |
production |
2026-09-18 |
| elastic |
AWS EC2 Deprecated AMI Discovery |
production |
2026-09-18 |