| elastic |
AWS Lambda Layer Shared Externally |
production |
2026-09-18 |
| elastic |
First Time AWS CloudFormation Stack Creation |
production |
2026-09-18 |
| elastic |
AWS SSM Command Document Created by Rare User |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` Execution by Rare User |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
AWS EC2 AMI Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Shared or Made Public |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS EC2 Full Network Packet Capture Detected |
production |
2026-09-18 |
| elastic |
AWS ECR Repository or Registry Policy Granted Public Access |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
AWS RDS DB Snapshot Shared with Another Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Allow Public Access |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-09-18 |
| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS SNS Rare Protocol Subscription by User |
production |
2026-09-18 |
| elastic |
AWS Account Closed |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Enumeration or Brute Force |
production |
2026-09-18 |
| elastic |
AWS Backup Vault Deleted or Vault Lock Removed |
production |
2026-09-18 |
| elastic |
First Time Seen Remote Monitoring and Management Tool |
production |
2026-09-18 |
| elastic |
Multiple Remote Management Tool Vendors on Same Host |
production |
2026-09-18 |
| elastic |
Ingress Transfer via Windows BITS |
production |
2026-09-18 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| elastic |
Potential File Download via a Headless Browser |
production |
2026-09-18 |
| elastic |
Connection to Commonly Abused Free SSL Certificate Providers |
production |
2026-09-18 |
| elastic |
Potential DNS Tunneling via NsLookup |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Updated |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 Encryption Disabled |
production |
2026-09-18 |
| elastic |
AWS EC2 EBS Snapshot Access Removed |
production |
2026-09-18 |
| elastic |
AWS Potential Cryptomining via ECS Task Definition Deployment |
production |
2026-09-18 |
| elastic |
AWS EFS File System Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-09-18 |