AlphaSOC Detections

AE can identify both known and unknown emerging threats. AlphaSOC’s threat detections leverage the comprehensive techniques outlined in the Capabilities section to secure multiple layers, including Network, Infrastructure, and Identity, using data from various origins. These detections deliver high-fidelity alerts with a low false positive ratio, enabling security teams to prioritize real threats with minimal distractions.

The table below is an exhaustive list of the individual detections that the engine supports.

Search

x

Data Types

any_type

Title	Data Type	Severity
C2 communication attempt indicating infection	DNS, IP, HTTP, TLS	Critical
Traffic to a malicious spear phishing site	DNS, HTTP	Critical
Traffic to a suspicious young domain impersonating a known brand	DNS, HTTP	Critical
AWS API calls by a malicious caller	AWS CloudTrail	High
AWS API calls indicating setup of mass mailer script	AWS CloudTrail	High
AWS EC2 credential used from an unknown external location	AWS CloudTrail	High
AWS EC2 credential used from an unknown external location Beta	AWS CloudTrail	High
AWS WorkMail mailbox exported to a bucket that was made public	AWS CloudTrail	High
AWS console login from an EC2 instance	AWS CloudTrail	High
AWS policy modified to allow any principal to assume an IAM role	AWS CloudTrail	High
AWS root access key created	AWS CloudTrail	High
Anonymizing circuit setup indicating infection or evasion attempt	IP	High
Cryptomining indicating infection or resource abuse	DNS, IP, HTTP	High
Domain resolves to 169.254.169.254 indicating an AWS rebinding attack	DNS, HTTP	High
Encrypted DNS traffic to a server that supports non-ICANN TLDs	DNS, IP, HTTP	High
Excessive number of HTTP failures to a known bad destination	HTTP	High
HTTP GET request to a known bad destination indicating infection	HTTP	High
HTTP POST to a known bad destination indicating infection	HTTP	High
Known bad dynamic DNS provider traffic	DNS, HTTP	High
Known bad tunneling provider traffic	DNS, IP, HTTP	High
Kubernetes API calls by a malicious caller Beta	Kubernetes	High
Multiple requests to DGA domains indicating infection	DNS, HTTP	High
Multiple requests to long hostnames indicating DNS tunneling	DNS, HTTP	High
Multiple suspicious connections indicating TrickBot infection	DNS, IP, HTTP, TLS	High
Out-of-band application security testing traffic requiring investigation	DNS, IP, HTTP	High
Outbound TCP port scan indicating hacking tool use or infection	IP	High
Quarantine applied to possibly compromised AWS credentials	AWS CloudTrail	High
Suspicious AWS API calls with root account credentials	AWS CloudTrail	High
Suspicious IRC traffic indicating infection	DNS, IP	High
Suspicious SSH session masquerading as a different protocol	IP	High
Suspicious use of an AWS IAM role that was unused for a long period Beta	AWS CloudTrail	High
Telegram Bot API traffic indicating possible infection	DNS, HTTP	High
Traffic from multiple sources to a domain impersonating a known brand	DNS, HTTP	High
Traffic to a known malware distribution site	DNS, IP, HTTP	High
Traffic to a known sinkhole indicating infection	DNS, IP, HTTP	High
Traffic to a suspicious domain impersonating a known brand	DNS, HTTP	High
Traffic to a web server with a suspicious open directory on an unusual port	DNS, IP, HTTP	High
Traffic to a young suspicious domain containing a brand name	DNS, HTTP	High
Traffic to malicious infrastructure capturing credentials	DNS, IP, HTTP	High
A team member was logged out due to a compromised device	Slack	Medium
AWS API calls indicating S3 buckets discovery in a suspicious way Beta	AWS CloudTrail	Medium
AWS API calls with root account access key	AWS CloudTrail	Medium
AWS DataSync task initiated to an unknown external account	AWS CloudTrail	Medium
AWS Detective graph deleted Beta	AWS CloudTrail	Medium
AWS EBS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
AWS EC2 export task to an unknown S3 bucked initiated	AWS CloudTrail	Medium
AWS EC2 instance unexpectedly interacted with the IAM API	AWS CloudTrail	Medium
AWS EC2 instances unexpectedly described in multiple regions	AWS CloudTrail	Medium
AWS ECR public repository modified to allow global write access	AWS CloudTrail	Medium
AWS EKS access entry unexpectedly created allowing admin access Beta	AWS CloudTrail	Medium
AWS Elastic IP address transfer to an unknown external account	AWS CloudTrail	Medium
AWS GuardDuty disabled	AWS CloudTrail	Medium
AWS GuardDuty publishing destination deleted Beta	AWS CloudTrail	Medium
AWS IAM policy modified to allow access to any resource via suspicious statement	AWS CloudTrail	Medium
AWS IAM user created with admin policy attached Beta	AWS CloudTrail	Medium
AWS KMS key modified to allow public access	AWS CloudTrail	Medium
AWS RDS export task to an unknown S3 bucket initiated	AWS CloudTrail	Medium
AWS RDS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS RDS snapshot unexpectedly created and made public	AWS CloudTrail	Medium
AWS Redshift cluster modified to allow public access Beta	AWS CloudTrail	Medium
AWS Route 53 domain transfer to an unknown external account	AWS CloudTrail	Medium
AWS S3 bucket accidentally modified to allow public access	AWS CloudTrail	Medium
AWS S3 bucket modified to allow public access via suspicious statement	AWS CloudTrail	Medium
AWS S3 bucket replication to an unknown external account	AWS CloudTrail	Medium
AWS S3 object accessed without TLS	AWS CloudTrail	Medium
AWS S3 object accessed without authentication	AWS CloudTrail	Medium
AWS S3 object encrypted using an external KMS key	AWS CloudTrail	Medium
AWS SES identities discovery via access key	AWS CloudTrail	Medium
AWS SNS Topic modified to allow public access	AWS CloudTrail	Medium
AWS SQS Queue modified to allow public access	AWS CloudTrail	Medium
AWS Security Hub disabled Beta	AWS CloudTrail	Medium
AWS VPC peering connection to an unknown external account established	AWS CloudTrail	Medium
AWS access key created by the root account	AWS CloudTrail	Medium
AWS access key used to delete itself unexpectedly	AWS CloudTrail	Medium
AWS account password policy changed in a suspicious way	AWS CloudTrail	Medium
AWS decoy resource accessed	AWS CloudTrail	Medium
AWS policy allows passing any role	AWS CloudTrail	Medium
AWS policy allows to perform any action via suspicious statement	AWS CloudTrail	Medium
AWS policy modified to allow unknown principal to assume an IAM role Beta	AWS CloudTrail	Medium
AWS policy suggests denial but allows actions	AWS CloudTrail	Medium
AWS policy suggests narrow access but allows broad access	AWS CloudTrail	Medium
AWS policy suggests read-only access but allows write actions	AWS CloudTrail	Medium
AWS role assumed by an unknown external principal	AWS CloudTrail	Medium
AWS root account unexpectedly assumed via temporary credentials	AWS CloudTrail	Medium
AWS root password recovery request from an unknown ASN	AWS CloudTrail	Medium
AWS service quota unexpectedly described in multiple regions	AWS CloudTrail	Medium
Anonymous access unexpectedly granted to a Kubernetes cluster Beta	Kubernetes	Medium
Beaconing to a rare domain	DNS, HTTP	Medium
Beaconing to a suspicious domain	DNS, HTTP	Medium
Cluster of suspicious requests requiring investigation	DNS, IP, HTTP	Medium
Excessive disruption of Slack user sessions via invalidation	Slack	Medium
Excessive number of HTTP failures to a suspicious destination	HTTP	Medium
GitHub API calls by a malicious caller Beta	GitHub	Medium
GitHub audit log stream destroyed or paused Beta	GitHub	Medium
GitHub organization is transferred to another enterprise account Beta	GitHub	Medium
GitHub personal access token used to download high number of repositories Beta	GitHub	Medium
GitHub repository transferred to another enterprise account Beta	GitHub	Medium
GitHub secret scanning disabled or bypassed Beta	GitHub	Medium
High volume of outbound ICMP traffic indicating tunneling	IP	Medium
High volume of outbound traffic over FTP	IP	Medium
High volume of outbound traffic over SMB	IP	Medium
High volume of outbound traffic over SSH	IP	Medium
High volume of reverse DNS lookups indicating scanning activity	DNS	Medium
IRC traffic requiring investigation	DNS, IP	Medium
MFA delete disabled on AWS S3 bucket Beta	AWS CloudTrail	Medium
Multiple AWS EC2 instances launched unexpectedly	AWS CloudTrail	Medium
Multiple AWS IAM users deleted within a short period Beta	AWS CloudTrail	Medium
Multiple connections to suspicious IP destinations	IP	Medium
Multiple denied AWS assume role API calls requiring investigation	AWS CloudTrail	Medium
Multiple encrypted DNS requests requiring investigation	DNS, IP, HTTP	Medium
Multiple requests to a rare domain	DNS, HTTP	Medium
Multiple requests to suspicious domains	DNS, HTTP	Medium
Multiple unexpected AWS API calls executed in dry run mode	AWS CloudTrail	Medium
Okta FastPass blocked a phishing attempt Beta	Okta	Medium
Okta MFA bypass attempt detected Beta	Okta	Medium
Outbound SSH session using an uncommon server port	IP	Medium
Outbound traffic indicating Denial of Service attack	IP	Medium
P2P activity	DNS, IP, HTTP	Medium
Potential ransomware note uploaded to an AWS S3 bucket	AWS CloudTrail	Medium
Potentially unwanted program or browser extension installed	DNS, IP, HTTP	Medium
Previously unseen AWS Bedrock model invoked Beta	AWS CloudTrail	Medium
Secret found in a GitHub repository Beta	GitHub	Medium
Several unsuccessful AWS console login attempts from the same IP address for different users	AWS CloudTrail	Medium
Several unsuccessful Slack login attempts indicating brute force activity	Slack	Medium
Slack API calls by a malicious caller	Slack	Medium
Slack EKM Unenrolled	Slack	Medium
Slack application access expanded with admin scopes	Slack	Medium
Slack application with admin scopes added	Slack	Medium
Slack login with unexpected user email	Slack	Medium
Slack organization deleted	Slack	Medium
Slack service owner transferred	Slack	Medium
Successful AWS console login without MFA	AWS CloudTrail	Medium
Suspicious AWS API call with account access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS API Gateway keys access Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS Backup plan deletion Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS DynamoDB backup restoration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS EC2 subnet deletion Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS Firehose delivery stream destination change Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS RDS instance with disabled encryption Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS SageMaker presigned URL generation Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating ECS cluster creation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating IP set modification	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Organizations discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating RDS data destruction	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 delete operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 write operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SAML activity	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SES discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating STS discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating WAF disassociation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating change of IAM user password	AWS CloudTrail	Medium
Suspicious AWS API calls indicating command execution via System Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating disruption	AWS CloudTrail	Medium
Suspicious AWS API calls indicating evasion	AWS CloudTrail	Medium
Suspicious AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of config monitoring	AWS CloudTrail	Medium
Suspicious AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Medium
Suspicious AWS API calls indicating persistence	AWS CloudTrail	Medium
Suspicious AWS API calls indicating privilege escalation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating resource enumeration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Medium
Suspicious AWS API calls indicating unauthorized access	AWS CloudTrail	Medium
Suspicious AWS IAM user created with generic name	AWS CloudTrail	Medium
Suspicious AWS access key created	AWS CloudTrail	Medium
Suspicious AWS console login	AWS CloudTrail	Medium
Suspicious HTTP GET request requiring investigation	HTTP	Medium
Suspicious Kubernetes API calls indicating access to Kubernetes secret Beta	Kubernetes	Medium
Suspicious Kubernetes API calls indicating permission discovery Beta	Kubernetes	Medium
Suspicious Okta API calls indicating Okta MFA modification Beta	Okta	Medium
Suspicious Okta API calls indicating Okta application modification Beta	Okta	Medium
Suspicious Okta API calls indicating Okta application sign on policy modification Beta	Okta	Medium
Suspicious Okta API calls indicating Okta identity provider creation Beta	Okta	Medium
Suspicious Okta API calls indicating Okta user creation Beta	Okta	Medium
Suspicious Okta API calls indicating Okta user profile modification Beta	Okta	Medium
Suspicious Okta user session created Beta	Okta	Medium
Suspicious Tor DNS request	DNS	Medium
Suspicious dynamic DNS provider traffic	DNS, HTTP	Medium
Suspicious file downloaded from Slack	Slack	Medium
Suspicious hosting provider traffic	DNS, HTTP	Medium
Suspicious traffic to DNS server that supports non-ICANN TLDs	IP	Medium
Suspicious traffic to a link-in-bio destination	DNS, HTTP	Medium
Suspicious traffic to user survey site indicating possible phishing	DNS, HTTP	Medium
Suspicious tunneling provider traffic	DNS, IP, HTTP	Medium
Third-party VPN traffic	DNS, IP, HTTP	Medium
Third-party remote access software installed	DNS, IP, HTTP	Medium
Traffic from multiple sources to a unique young domain	DNS, HTTP	Medium
Traffic over a cleartext protocol exposing content and credentials	IP	Medium
Traffic to a TDS mechanism requiring investigation	DNS, HTTP	Medium
Traffic to a destination serving malicious JavaScript	DNS, HTTP	Medium
Traffic to a free webhook service indicating potential exfiltration	DNS, HTTP	Medium
Traffic to a likely malicious domain	DNS, HTTP	Medium
Traffic to a suspicious domain containing a brand name	DNS, HTTP	Medium
Traffic to a web server with a suspicious open directory	DNS, IP, HTTP	Medium
Traffic to a young domain impersonating a known brand	DNS, HTTP	Medium
Traffic to an unknown blocklisted destination	DNS, IP, HTTP	Medium
Traffic to an unusual and suspicious port requiring investigation	IP	Medium
Unexpected AWS API calls with root account credentials	AWS CloudTrail	Medium
Unexpected AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
Unexpected AWS role assumed by an external principal	AWS CloudTrail	Medium
Unexpected anonymous API call to a Kubernetes cluster Beta	Kubernetes	Medium
Unsuccessful and unexpected attempt to assume AWS root account	AWS CloudTrail	Medium
Unusual excessive AWS S3 bucket deletion requests Beta	AWS CloudTrail	Medium
Unusual mail traffic indicating possible implant	IP	Medium
Use of an AWS IAM access key that was unused for a long period Beta	AWS CloudTrail	Medium
Use of an AWS IAM role that was unused for a long period Beta	AWS CloudTrail	Medium
Use of an AWS IAM user that was unused for a long period Beta	AWS CloudTrail	Medium
User activity from previously unseen ASN	AWS CloudTrail	Medium
User activity from previously unseen country	AWS CloudTrail	Medium
A large AWS EC2 instance launch with an unusual instance type	AWS CloudTrail	Low
AWS ACM certificate authority deleted Beta	AWS CloudTrail	Low
AWS AMI modified to allow public access	AWS CloudTrail	Low
AWS API calls indicating S3 buckets discovery Beta	AWS CloudTrail	Low
AWS API calls indicating evasion attempts on Amazon Macie	AWS CloudTrail	Low
AWS API calls indicating tampering with Security Hub findings	AWS CloudTrail	Low
AWS Application Load Balancer configured with insecure SSL protocol policy Beta	AWS CloudTrail	Low
AWS CloudFront distribution configured with insecure SSL protocol policy Beta	AWS CloudTrail	Low
AWS CloudWatch alarm deleted	AWS CloudTrail	Low
AWS CodeBuild project modified to allow public access	AWS CloudTrail	Low
AWS DataSync task initiated unexpectedly	AWS CloudTrail	Low
AWS EBS default encryption disabled	AWS CloudTrail	Low
AWS EC2 export task initiated unexpectedly	AWS CloudTrail	Low
AWS EC2 instance interacted with the IAM API	AWS CloudTrail	Low
AWS EC2 instance launch in a new region	AWS CloudTrail	Low
AWS EC2 instance launches in multiple regions	AWS CloudTrail	Low
AWS EC2 instances described in multiple regions	AWS CloudTrail	Low
AWS ECR image uploaded	AWS CloudTrail	Low
AWS ECS cluster unexpectedly deleted Beta	AWS CloudTrail	Low
AWS EKS access entry created allowing admin access Beta	AWS CloudTrail	Low
AWS EKS cluster endpoint modified to allow public access Beta	AWS CloudTrail	Low
AWS ElastiCache Redis cluster created without encryption at rest	AWS CloudTrail	Low
AWS ElastiCache security group modified unexpectedly	AWS CloudTrail	Low
AWS GuardDuty threat list disabled	AWS CloudTrail	Low
AWS IAM Access Analyzer deleted Beta	AWS CloudTrail	Low
AWS IAM entity created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile unexpectedly modified by a different identity than the owner	AWS CloudTrail	Low
AWS IAM policy granting full or admin access attached	AWS CloudTrail	Low
AWS IAM policy modified to allow access to any resource	AWS CloudTrail	Low
AWS IAM user created with generic name unexpectedly	AWS CloudTrail	Low
AWS IAM user groups discovery	AWS CloudTrail	Low
AWS IAM user profile created without password reset	AWS CloudTrail	Low
AWS KMS customer managed key disabled or scheduled for deletion	AWS CloudTrail	Low
AWS Lambda function modified to allow public invocation	AWS CloudTrail	Low
AWS Lambda functions modified	AWS CloudTrail	Low
AWS Lightsail instance launched unexpectedly	AWS CloudTrail	Low
AWS MFA device disabled unexpectedly	AWS CloudTrail	Low
AWS MFA device registered unexpectedly	AWS CloudTrail	Low
AWS OpenSearch domain configured to allow public access Beta	AWS CloudTrail	Low
AWS Organization invite sent for another account to join the organization Beta	AWS CloudTrail	Low
AWS RDS Deletion Protection disabled unexpectedly	AWS CloudTrail	Low
AWS RDS export task initiated unexpectedly	AWS CloudTrail	Low
AWS RDS instance modified to allow public access	AWS CloudTrail	Low
AWS RDS instance password changed unexpectedly	AWS CloudTrail	Low
AWS RDS security group created unexpectedly	AWS CloudTrail	Low
AWS RDS snapshot created and made public	AWS CloudTrail	Low
AWS RDS snapshot created manually	AWS CloudTrail	Low
AWS Redshift cluster encryption disabled Beta	AWS CloudTrail	Low
AWS Roles Anywhere profile created	AWS CloudTrail	Low
AWS Route 53 hosted zone associated with a VPC	AWS CloudTrail	Low
AWS Route 53 public hosted zone created unexpectedly	AWS CloudTrail	Low
AWS S3 bucket modified to allow public access	AWS CloudTrail	Low
AWS S3 bucket versioning suspended unexpectedly	AWS CloudTrail	Low
AWS SES GetAccount action invoked via AccessKey	AWS CloudTrail	Low
AWS SES identity deleted	AWS CloudTrail	Low
AWS SES production access granted	AWS CloudTrail	Low
AWS STS GetFederationToken invoked by aws_consoler utility Beta	AWS CloudTrail	Low
AWS SageMaker domain modified to allow public access Beta	AWS CloudTrail	Low
AWS System Manager encrypted parameter retrieved unexpectedly	AWS CloudTrail	Low
AWS WorkMail mailbox exported	AWS CloudTrail	Low
AWS access key created for a newly registered IAM user	AWS CloudTrail	Low
AWS access key created unexpectedly	AWS CloudTrail	Low
AWS access key used to delete itself	AWS CloudTrail	Low
AWS account created unexpectedly	AWS CloudTrail	Low
AWS account password policy changed in an unexpected way	AWS CloudTrail	Low
AWS account password policy deleted	AWS CloudTrail	Low
AWS identity added to an admin group	AWS CloudTrail	Low
AWS network infrastructure modification opening a wide range of ports	AWS CloudTrail	Low
AWS policy contains unsubstituted template values	AWS CloudTrail	Low
AWS policy that allows to perform any action was added	AWS CloudTrail	Low
AWS region was enabled or disabled Beta	AWS CloudTrail	Low
AWS root account assumed via temporary credentials	AWS CloudTrail	Low
AWS service quota described in multiple regions	AWS CloudTrail	Low
AWS service quota increase request created Beta	AWS CloudTrail	Low
An AWS account removed itself from the organization	AWS CloudTrail	Low
Anonymous access granted to a Kubernetes cluster Beta	Kubernetes	Low
Connection to an AWS EC2 instance using EC2 Instance Connect by a suspicious user	AWS CloudTrail	Low
Connection to multiple AWS EC2 instances using EC2 Instance Connect	AWS CloudTrail	Low
DNS misconfiguration leading to potential compromise	DNS	Low
Encrypted DNS traffic indicating potential infection or evasion	DNS, IP, HTTP	Low
Excessive number of DNS failures requiring investigation	DNS	Low
Excessive number of HTTP failures to an uncommon destination	HTTP	Low
GitHub OAuth application access restrictions disabled Beta	GitHub	Low
GitHub Personal Access Token approval policy modified Beta	GitHub	Low
GitHub SSO configuration modified for organization or enterprise Beta	GitHub	Low
GitHub account recovery codes accessed Beta	GitHub	Low
GitHub audit log stream modified Beta	GitHub	Low
GitHub branch protections were disabled for the repository Beta	GitHub	Low
GitHub dependabot vulnerability alerts disabled Beta	GitHub	Low
GitHub enterprise deleted Beta	GitHub	Low
GitHub organization was removed from an enterprise Beta	GitHub	Low
GitHub repository deploy key modified or created Beta	GitHub	Low
GitHub repository visibility changed to public Beta	GitHub	Low
High number of non-public GitHub repositories downloaded Beta	GitHub	Low
IAM default policy set to an unexpected version	AWS CloudTrail	Low
IAM role attached to an AWS RDS instance unexpectedly	AWS CloudTrail	Low
MFA disabled for GitHub organization or enterprise Beta	GitHub	Low
Malicious pop-up traffic	DNS, HTTP	Low
Many AWS Route 53 domains registered	AWS CloudTrail	Low
Modification of multiple AWS EC2 instance startup scripts	AWS CloudTrail	Low
Multiple AWS API calls executed in dry run mode	AWS CloudTrail	Low
Multiple AWS EC2 instances launched	AWS CloudTrail	Low
Multiple AWS EC2 instances terminated unexpectedly	AWS CloudTrail	Low
Multiple AWS root password recovery requests	AWS CloudTrail	Low
Multiple denied AWS API calls requiring investigation	AWS CloudTrail	Low
Multiple denied AWS S3 API calls requiring investigation	AWS CloudTrail	Low
Multiple requests to unreachable domains	DNS, HTTP	Low
Okta admin role assigned Beta	Okta	Low
Okta privilege granted Beta	Okta	Low
Outbound RDP traffic indicating brute force activity	IP	Low
Outbound SSH traffic indicating brute force activity	IP	Low
Outbound WinRM traffic indicating brute force activity	IP	Low
Registered domain impersonating a known brand	DNS	Low
Several unsuccessful AWS console login attempts for a user	AWS CloudTrail	Low
Several unsuccessful AWS console login attempts from the same IP address	AWS CloudTrail	Low
Several unsuccessful Okta login attempts for a user Beta	Okta	Low
Slack API calls from an unexpected IP address	Slack	Low
Slack API calls from an unexpected client	Slack	Low
Slack API calls from an unexpected user agent	Slack	Low
Slack EKM config modified	Slack	Low
Slack Microsoft Intune MDM disabled	Slack	Low
Slack SSO restriction changed	Slack	Low
Slack app removed	Slack	Low
Slack application access expanded	Slack	Low
Slack application added	Slack	Low
Slack data prevention rule was modified	Slack	Low
Slack identity provider config modified	Slack	Low
Slack information barrier modified	Slack	Low
Slack legal hold policy modified	Slack	Low
Slack manual export downloaded	Slack	Low
Slack public link created to file with potentially sensitive data	Slack	Low
Slack user privilege escalation	Slack	Low
Successful AWS console login from a new country	AWS CloudTrail	Low
Successful Okta user session created from a new country Beta	Okta	Low
Successful anonymous API call to a Kubernetes cluster Beta	Kubernetes	Low
Suspicious HTTP POST request requiring investigation	HTTP	Low
Traffic to a suspicious IP destination	IP	Low
Traffic to a suspicious domain	DNS, HTTP	Low
Traffic to a valid domain impersonating a known brand	DNS, HTTP	Low
Traffic to a web server with an open directory on an unusual port	DNS, IP, HTTP	Low
Traffic to an IP lookup service	DNS, IP, HTTP	Low
Traffic to an unusual DNS resolver	IP	Low
Traffic to an unusual port requiring investigation	IP	Low
Unexpected AWS API call with account access key	AWS CloudTrail	Low
Unexpected AWS API calls by a likely malicious caller	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS API Gateway keys access Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS Backup plan deletion Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS DynamoDB backup restoration	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS EC2 subnet deletion Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS Firehose delivery stream destination change Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS RDS instance with disabled encryption Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS SageMaker presigned URL generation Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating ECS cluster creation	AWS CloudTrail	Low
Unexpected AWS API calls indicating IP set modification	AWS CloudTrail	Low
Unexpected AWS API calls indicating Organizations discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating RDS data destruction	AWS CloudTrail	Low
Unexpected AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 delete operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 write operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating SAML activity	AWS CloudTrail	Low
Unexpected AWS API calls indicating SES discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating STS discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating WAF disassociation	AWS CloudTrail	Low
Unexpected AWS API calls indicating change of IAM user password	AWS CloudTrail	Low
Unexpected AWS API calls indicating command execution via System Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Low
Unexpected AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Low
Unexpected AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Low
Unexpected AWS API calls indicating disruption	AWS CloudTrail	Low
Unexpected AWS API calls indicating evasion	AWS CloudTrail	Low
Unexpected AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of config monitoring	AWS CloudTrail	Low
Unexpected AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Low
Unexpected AWS API calls indicating persistence	AWS CloudTrail	Low
Unexpected AWS API calls indicating privilege escalation	AWS CloudTrail	Low
Unexpected AWS API calls indicating reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating resource enumeration	AWS CloudTrail	Low
Unexpected AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Low
Unexpected AWS API calls indicating unauthorized access	AWS CloudTrail	Low
Unexpected AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Low
Unexpected AWS EC2 instance launch	AWS CloudTrail	Low
Unexpected AWS IAM group deletion	AWS CloudTrail	Low
Unexpected AWS console login	AWS CloudTrail	Low
Unexpected AWS role assumed by a principal	AWS CloudTrail	Low
Unexpected Kubernetes API calls by a likely malicious caller Beta	Kubernetes	Low
Unexpected Kubernetes API calls indicating access to Kubernetes secret Beta	Kubernetes	Low
Unexpected Kubernetes API calls indicating permission discovery Beta	Kubernetes	Low
Unexpected Okta API calls indicating Okta MFA modification Beta	Okta	Low
Unexpected Okta API calls indicating Okta application modification Beta	Okta	Low
Unexpected Okta API calls indicating Okta application sign on policy modification Beta	Okta	Low
Unexpected Okta API calls indicating Okta identity provider creation Beta	Okta	Low
Unexpected Okta API calls indicating Okta user creation Beta	Okta	Low
Unexpected Okta API calls indicating Okta user profile modification Beta	Okta	Low
Unexpected Okta user session created Beta	Okta	Low
Unexpected Slack API actions from admin account	Slack	Low
Unexpected Slack API calls indicating credential testing activity	Slack	Low
Unexpected Slack API calls indicating excessive downloads	Slack	Low
Unexpected Slack API calls indicating excessive file sharing	Slack	Low
Unexpected Slack API calls indicating malware share	Slack	Low
Unexpected Slack API calls indicating message deletion activity	Slack	Low
Unexpected Slack API calls indicating scraping activity	Slack	Low
Unexpected Slack session with inconsistent client fingerprint	Slack	Low
Unexpected high volume of Slack API calls	Slack	Low
Unknown dynamic DNS provider traffic	DNS, HTTP	Low
Unknown tunneling provider traffic	DNS, IP, HTTP	Low
Unsuccessful AWS IAM password change attempt	AWS CloudTrail	Low
Unsuccessful attempt to assume AWS root account	AWS CloudTrail	Low
Unusual AWS API calls with root account credentials	AWS CloudTrail	Low
Unusual excessive traffic requiring investigation	IP	Low
User activity from unexpected ASN	AWS CloudTrail	Low
User activity from unexpected country	AWS CloudTrail	Low
AWS AMI Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS API calls by a likely malicious caller	AWS CloudTrail	Informational
AWS API calls indicating AWS API Gateway keys access Beta	AWS CloudTrail	Informational
AWS API calls indicating AWS Backup plan deletion Beta	AWS CloudTrail	Informational
AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Informational
AWS API calls indicating AWS EC2 subnet deletion Beta	AWS CloudTrail	Informational
AWS API calls indicating AWS Firehose delivery stream destination change Beta	AWS CloudTrail	Informational
AWS API calls indicating AWS RDS instance with disabled encryption Beta	AWS CloudTrail	Informational
AWS API calls indicating AWS SageMaker presigned URL generation Beta	AWS CloudTrail	Informational
AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Informational
AWS API calls indicating ECS cluster creation	AWS CloudTrail	Informational
AWS API calls indicating IP set modification	AWS CloudTrail	Informational
AWS API calls indicating Organizations discovery	AWS CloudTrail	Informational
AWS API calls indicating RDS data destruction	AWS CloudTrail	Informational
AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Informational
AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Informational
AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating S3 delete operations	AWS CloudTrail	Informational
AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating S3 write operations	AWS CloudTrail	Informational
AWS API calls indicating SAML activity	AWS CloudTrail	Informational
AWS API calls indicating SES discovery	AWS CloudTrail	Informational
AWS API calls indicating STS discovery	AWS CloudTrail	Informational
AWS API calls indicating WAF disassociation	AWS CloudTrail	Informational
AWS API calls indicating change of IAM user password	AWS CloudTrail	Informational
AWS API calls indicating command execution via System Manager	AWS CloudTrail	Informational
AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Informational
AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Informational
AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Informational
AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Informational
AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Informational
AWS API calls indicating disruption	AWS CloudTrail	Informational
AWS API calls indicating evasion	AWS CloudTrail	Informational
AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Informational
AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Informational
AWS API calls indicating modification of config monitoring	AWS CloudTrail	Informational
AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Informational
AWS API calls indicating persistence	AWS CloudTrail	Informational
AWS API calls indicating privilege escalation	AWS CloudTrail	Informational
AWS API calls indicating reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating resource enumeration	AWS CloudTrail	Informational
AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Informational
AWS API calls indicating unauthorized access	AWS CloudTrail	Informational
AWS API calls with root account credentials	AWS CloudTrail	Informational
AWS DataSync task initiated	AWS CloudTrail	Informational
AWS DynamoDB table restored from backup	AWS CloudTrail	Informational
AWS EBS snapshot Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS EC2 NAT gateway deleted Beta	AWS CloudTrail	Informational
AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Informational
AWS ECS cluster deleted Beta	AWS CloudTrail	Informational
AWS ElastiCache security group modified	AWS CloudTrail	Informational
AWS GuardDuty threat list modified	AWS CloudTrail	Informational
AWS IAM default policy version set	AWS CloudTrail	Informational
AWS IAM group deleted	AWS CloudTrail	Informational
AWS IAM login profile created	AWS CloudTrail	Informational
AWS IAM login profile modified by a different identity than the owner	AWS CloudTrail	Informational
AWS IAM permission boundary deleted	AWS CloudTrail	Informational
AWS IAM policy modified	AWS CloudTrail	Informational
AWS IAM user created with generic name	AWS CloudTrail	Informational
AWS MFA device disabled	AWS CloudTrail	Informational
AWS MFA device registered	AWS CloudTrail	Informational
AWS RDS Deletion Protection disabled	AWS CloudTrail	Informational
AWS RDS instance password changed	AWS CloudTrail	Informational
AWS RDS security group created	AWS CloudTrail	Informational
AWS Roles Anywhere trust anchor created with an external CA	AWS CloudTrail	Informational
AWS Route 53 domain registered	AWS CloudTrail	Informational
AWS Route 53 domain transfer lock disabled for an account	AWS CloudTrail	Informational
AWS Route 53 domain transfer to an external account	AWS CloudTrail	Informational
AWS Route 53 public hosted zone created	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for a bucket	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS S3 bucket versioning suspended	AWS CloudTrail	Informational
AWS S3 server access logging disabled	AWS CloudTrail	Informational
AWS SES service modified	AWS CloudTrail	Informational
AWS SSO access token created	AWS CloudTrail	Informational
AWS System Manager encrypted parameter retrieved	AWS CloudTrail	Informational
AWS access key created	AWS CloudTrail	Informational
AWS account closed	AWS CloudTrail	Informational
AWS account created	AWS CloudTrail	Informational
AWS account password policy changed	AWS CloudTrail	Informational
AWS role assumed by an external principal with an unexpected user agent	AWS CloudTrail	Informational
AWS root password recovery request	AWS CloudTrail	Informational
AWS security group modification allowing access from any IP address	AWS CloudTrail	Informational
Adversary simulation traffic to a benign destination	DNS, IP, HTTP	Informational
Connection to an AWS EC2 instance using EC2 Instance Connect	AWS CloudTrail	Informational
Encrypted DNS traffic to a common destination	DNS, IP, HTTP	Informational
Enumeration of AWS EC2 instance startup scripts	AWS CloudTrail	Informational
GitHub User was added to an organization Beta	GitHub	Informational
GitHub application installed Beta	GitHub	Informational
GitHub repository ruleset was modified Beta	GitHub	Informational
GitHub repository was deleted Beta	GitHub	Informational
GitHub user was blocked from accessing an organization’s repositories Beta	GitHub	Informational
GitHub user was invited to a repository Beta	GitHub	Informational
GitHub user was unblocked from accessing an organization’s repositories Beta	GitHub	Informational
IAM role attached to an AWS RDS instance	AWS CloudTrail	Informational
Kubernetes API calls by a likely malicious caller Beta	Kubernetes	Informational
Kubernetes API calls indicating access to Kubernetes secret Beta	Kubernetes	Informational
Kubernetes API calls indicating permission discovery Beta	Kubernetes	Informational
Long AWS console session	AWS CloudTrail	Informational
MFA disabled for Slack organization	Slack	Informational
Modification of an AWS EC2 instance startup script	AWS CloudTrail	Informational
Multiple archived files uploaded to Slack in a short period	Slack	Informational
New Okta API token was generated Beta	Okta	Informational
Okta API calls indicating Okta MFA modification Beta	Okta	Informational
Okta API calls indicating Okta application modification Beta	Okta	Informational
Okta API calls indicating Okta application sign on policy modification Beta	Okta	Informational
Okta API calls indicating Okta identity provider creation Beta	Okta	Informational
Okta API calls indicating Okta user creation Beta	Okta	Informational
Okta API calls indicating Okta user profile modification Beta	Okta	Informational
Okta MFA challenge without MFA app Beta	Okta	Informational
Okta user session created Beta	Okta	Informational
Outbound traffic over SMB requiring investigation	IP	Informational
Private Slack channel was changed to public	Slack	Informational
Quarantine self applied to AWS credentials	AWS CloudTrail	Informational
Slack organization created	Slack	Informational
Slack user role changed	Slack	Informational
Successful AWS console login	AWS CloudTrail	Informational
Successful AWS console logins from different locations in a short period	AWS CloudTrail	Informational
Successful Okta user session created from different locations in a short period Beta	Okta	Informational
Traffic to a destination TLD commonly associated with malware	DNS, HTTP	Informational
Traffic to a destination with a known HTTP open directory	DNS, IP, HTTP	Informational
Traffic to a link-in-bio destination	DNS, HTTP	Informational
Traffic to a user survey site	DNS, HTTP	Informational
Traffic to an unknown young domain	DNS, HTTP	Informational
Unsuccessful AWS console login attempt	AWS CloudTrail	Informational