AlphaSOC Detections

AE can identify both known and unknown emerging threats. AlphaSOC’s threat detections leverage the comprehensive techniques outlined in the Capabilities section to secure multiple layers, including Network, Infrastructure, and Identity, using data from various origins. These detections deliver high-fidelity alerts with a low false positive ratio, enabling security teams to prioritize real threats with minimal distractions.

The table below is an exhaustive list of the individual detections that the engine supports.

Search

x

Data Types

any_type

Title	Data Type	Severity
C2 communication attempt indicating infection	DNS, IP, HTTP, TLS	Critical
Traffic to a malicious spear phishing site	DNS, HTTP	Critical
Traffic to a suspicious young domain impersonating a known brand	DNS, HTTP	Critical
AWS API calls by a malicious caller	AWS CloudTrail	High
AWS API calls indicating setup of mass mailer script	AWS CloudTrail	High
AWS EC2 credential used from an unknown external location	AWS CloudTrail	High
AWS WorkMail mailbox exported to a bucket that was made public	AWS CloudTrail	High
AWS console login from an EC2 instance	AWS CloudTrail	High
AWS policy modified to allow any principal to assume an IAM role	AWS CloudTrail	High
AWS root access key created	AWS CloudTrail	High
Anonymizing circuit setup indicating infection or evasion attempt	IP	High
Cryptomining indicating infection or resource abuse	DNS, IP, HTTP	High
Domain resolves to 169.254.169.254 indicating an AWS rebinding attack	DNS, HTTP	High
Encrypted DNS traffic to a server that supports non-ICANN TLDs	DNS, IP, HTTP	High
Excessive number of HTTP failures to a known bad destination	HTTP	High
HTTP GET request to a known bad destination indicating infection	HTTP	High
HTTP POST to a known bad destination indicating infection	HTTP	High
Known bad dynamic DNS provider traffic	DNS, HTTP	High
Known bad tunneling provider traffic	DNS, IP, HTTP	High
Multiple requests to DGA domains indicating infection	DNS, HTTP	High
Multiple requests to long hostnames indicating DNS tunneling	DNS, HTTP	High
Multiple suspicious connections indicating TrickBot infection	DNS, IP, HTTP, TLS	High
Out-of-band application security testing traffic requiring investigation	DNS, IP, HTTP	High
Outbound TCP port scan indicating hacking tool use or infection	IP	High
Quarantine applied to possibly compromised AWS credentials	AWS CloudTrail	High
Suspicious AWS API calls with root account credentials	AWS CloudTrail	High
Suspicious IRC traffic indicating infection	DNS, IP	High
Suspicious SSH session masquerading as a different protocol	IP	High
Telegram Bot API traffic indicating possible infection	DNS, HTTP	High
Traffic from multiple sources to a domain impersonating a known brand	DNS, HTTP	High
Traffic to a known malware distribution site	DNS, IP, HTTP	High
Traffic to a known sinkhole indicating infection	DNS, IP, HTTP	High
Traffic to a suspicious domain impersonating a known brand	DNS, HTTP	High
Traffic to a web server with a suspicious open directory on an unusual port	DNS, IP, HTTP	High
Traffic to a young suspicious domain containing a brand name	DNS, HTTP	High
Traffic to malicious infrastructure capturing credentials	DNS, IP, HTTP	High
AWS API calls with root account access key	AWS CloudTrail	Medium
AWS DataSync task initiated to an unknown external account	AWS CloudTrail	Medium
AWS EBS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
AWS EC2 export task to an unknown S3 bucked initiated	AWS CloudTrail	Medium
AWS EC2 instance unexpectedly interacted with the IAM API	AWS CloudTrail	Medium
AWS EC2 instances unexpectedly described in multiple regions	AWS CloudTrail	Medium
AWS ECR public repository modified to allow global write access	AWS CloudTrail	Medium
AWS Elastic IP address transfer to an unknown external account	AWS CloudTrail	Medium
AWS GuardDuty disabled	AWS CloudTrail	Medium
AWS IAM policy modified to allow access to any resource via suspicious statement	AWS CloudTrail	Medium
AWS KMS key modified to allow public access	AWS CloudTrail	Medium
AWS RDS export task to an unknown S3 bucket initiated	AWS CloudTrail	Medium
AWS RDS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS RDS snapshot unexpectedly created and made public	AWS CloudTrail	Medium
AWS Route 53 domain transfer to an unknown external account	AWS CloudTrail	Medium
AWS S3 bucket accidentally modified to allow public access	AWS CloudTrail	Medium
AWS S3 bucket modified to allow public access via suspicious statement	AWS CloudTrail	Medium
AWS S3 bucket replication to an unknown external account	AWS CloudTrail	Medium
AWS S3 object accessed without TLS	AWS CloudTrail	Medium
AWS S3 object accessed without authentication	AWS CloudTrail	Medium
AWS S3 object encrypted using an external KMS key	AWS CloudTrail	Medium
AWS SES identities discovery via access key	AWS CloudTrail	Medium
AWS SNS Topic modified to allow public access	AWS CloudTrail	Medium
AWS SQS Queue modified to allow public access	AWS CloudTrail	Medium
AWS VPC peering connection to an unknown external account established	AWS CloudTrail	Medium
AWS access key created by the root account	AWS CloudTrail	Medium
AWS access key used to delete itself unexpectedly	AWS CloudTrail	Medium
AWS account password policy changed in a suspicious way	AWS CloudTrail	Medium
AWS decoy resource accessed	AWS CloudTrail	Medium
AWS policy allows passing any role	AWS CloudTrail	Medium
AWS policy allows to perform any action via suspicious statement	AWS CloudTrail	Medium
AWS policy suggests denial but allows actions	AWS CloudTrail	Medium
AWS policy suggests narrow access but allows broad access	AWS CloudTrail	Medium
AWS policy suggests read-only access but allows write actions	AWS CloudTrail	Medium
AWS role assumed by an unknown external principal	AWS CloudTrail	Medium
AWS root account unexpectedly assumed via temporary credentials	AWS CloudTrail	Medium
AWS root password recovery request from an unknown ASN	AWS CloudTrail	Medium
AWS service quota unexpectedly described in multiple regions	AWS CloudTrail	Medium
Beaconing to a rare domain	DNS, HTTP	Medium
Beaconing to a suspicious domain	DNS, HTTP	Medium
Cluster of suspicious requests requiring investigation	DNS, IP, HTTP	Medium
Excessive number of HTTP failures to a suspicious destination	HTTP	Medium
High volume of outbound ICMP traffic indicating tunneling	IP	Medium
High volume of outbound traffic over FTP	IP	Medium
High volume of outbound traffic over SMB	IP	Medium
High volume of outbound traffic over SSH	IP	Medium
High volume of reverse DNS lookups indicating scanning activity	DNS	Medium
IRC traffic requiring investigation	DNS, IP	Medium
Multiple AWS EC2 instances launched unexpectedly	AWS CloudTrail	Medium
Multiple connections to suspicious IP destinations	IP	Medium
Multiple denied AWS assume role API calls requiring investigation	AWS CloudTrail	Medium
Multiple encrypted DNS requests requiring investigation	DNS, IP, HTTP	Medium
Multiple requests to a rare domain	DNS, HTTP	Medium
Multiple requests to suspicious domains	DNS, HTTP	Medium
Multiple unexpected AWS API calls executed in dry run mode	AWS CloudTrail	Medium
Outbound SSH session using an uncommon server port	IP	Medium
Outbound traffic indicating Denial of Service attack	IP	Medium
P2P activity	DNS, IP, HTTP	Medium
Potential ransomware note uploaded to an AWS S3 bucket	AWS CloudTrail	Medium
Potentially unwanted program or browser extension installed	DNS, IP, HTTP	Medium
Several unsuccessful AWS console login attempts from the same IP address for different users	AWS CloudTrail	Medium
Successful AWS console login without MFA	AWS CloudTrail	Medium
Suspicious AWS API call with account access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating AWS DynamoDB backup restoration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating ECS cluster creation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating IP set modification	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Organizations discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating RDS data destruction	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 delete operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 write operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SAML activity	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SES discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating STS discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating WAF disassociation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating change of IAM user password	AWS CloudTrail	Medium
Suspicious AWS API calls indicating command execution via System Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating disruption	AWS CloudTrail	Medium
Suspicious AWS API calls indicating evasion	AWS CloudTrail	Medium
Suspicious AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of config monitoring	AWS CloudTrail	Medium
Suspicious AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Medium
Suspicious AWS API calls indicating persistence	AWS CloudTrail	Medium
Suspicious AWS API calls indicating privilege escalation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating resource enumeration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Medium
Suspicious AWS API calls indicating unauthorized access	AWS CloudTrail	Medium
Suspicious AWS IAM user created with generic name	AWS CloudTrail	Medium
Suspicious AWS access key created	AWS CloudTrail	Medium
Suspicious AWS console login	AWS CloudTrail	Medium
Suspicious HTTP GET request requiring investigation	HTTP	Medium
Suspicious Tor DNS request	DNS	Medium
Suspicious dynamic DNS provider traffic	DNS, HTTP	Medium
Suspicious hosting provider traffic	DNS, HTTP	Medium
Suspicious traffic to DNS server that supports non-ICANN TLDs	IP	Medium
Suspicious traffic to a link-in-bio destination	DNS, HTTP	Medium
Suspicious traffic to user survey site indicating possible phishing	AWS CloudTrail	Medium
Suspicious tunneling provider traffic	DNS, IP, HTTP	Medium
Third-party VPN traffic	DNS, IP, HTTP	Medium
Third-party remote access software installed	DNS, IP, HTTP	Medium
Traffic from multiple sources to a unique young domain	DNS, HTTP	Medium
Traffic over a cleartext protocol exposing content and credentials	IP	Medium
Traffic to a TDS mechanism requiring investigation	DNS, HTTP	Medium
Traffic to a destination serving malicious JavaScript	DNS, HTTP	Medium
Traffic to a free webhook service indicating potential exfiltration	DNS, HTTP	Medium
Traffic to a likely malicious domain	DNS, HTTP	Medium
Traffic to a suspicious domain containing a brand name	DNS, HTTP	Medium
Traffic to a web server with a suspicious open directory	DNS, IP, HTTP	Medium
Traffic to a young domain impersonating a known brand	DNS, HTTP	Medium
Traffic to an unknown blocklisted destination	AWS CloudTrail	Medium
Traffic to an unusual and suspicious port requiring investigation	IP	Medium
Unexpected AWS API calls with root account credentials	AWS CloudTrail	Medium
Unexpected AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
Unexpected AWS role assumed by an external principal	AWS CloudTrail	Medium
Unsuccessful and unexpected attempt to assume AWS root account	AWS CloudTrail	Medium
Unusual mail traffic indicating possible implant	IP	Medium
User activity from previously unseen ASN	AWS CloudTrail	Medium
User activity from previously unseen country	AWS CloudTrail	Medium
A large AWS EC2 instance launch with an unusual instance type	AWS CloudTrail	Low
AWS AMI modified to allow public access	AWS CloudTrail	Low
AWS API calls indicating evasion attempts on Amazon Macie	AWS CloudTrail	Low
AWS API calls indicating tampering with SecurityHub findings	AWS CloudTrail	Low
AWS CloudWatch alarm deleted	AWS CloudTrail	Low
AWS CodeBuild project modified to allow public access	AWS CloudTrail	Low
AWS DataSync task initiated unexpectedly	AWS CloudTrail	Low
AWS EBS default encryption disabled	AWS CloudTrail	Low
AWS EC2 export task initiated unexpectedly	AWS CloudTrail	Low
AWS EC2 instance interacted with the IAM API	AWS CloudTrail	Low
AWS EC2 instance launch in a new region	AWS CloudTrail	Low
AWS EC2 instance launches in multiple regions	AWS CloudTrail	Low
AWS EC2 instances described in multiple regions	AWS CloudTrail	Low
AWS ECR image uploaded	AWS CloudTrail	Low
AWS ElastiCache Redis cluster created without encryption at rest	AWS CloudTrail	Low
AWS ElastiCache security group modified unexpectedly	AWS CloudTrail	Low
AWS GuardDuty threat list disabled	AWS CloudTrail	Low
AWS IAM entity created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile unexpectedly modified by a different identity than the owner	AWS CloudTrail	Low
AWS IAM policy granting full or admin access attached	AWS CloudTrail	Low
AWS IAM policy modified to allow access to any resource	AWS CloudTrail	Low
AWS IAM user created with generic name unexpectedly	AWS CloudTrail	Low
AWS IAM user groups discovery	AWS CloudTrail	Low
AWS IAM user profile created without password reset	AWS CloudTrail	Low
AWS KMS customer managed key disabled or scheduled for deletion	AWS CloudTrail	Low
AWS Lambda function modified to allow public invocation	AWS CloudTrail	Low
AWS Lambda functions modified	AWS CloudTrail	Low
AWS Lightsail instance launched unexpectedly	AWS CloudTrail	Low
AWS MFA device disabled unexpectedly	AWS CloudTrail	Low
AWS MFA device registered unexpectedly	AWS CloudTrail	Low
AWS RDS Deletion Protection disabled unexpectedly	AWS CloudTrail	Low
AWS RDS export task initiated unexpectedly	AWS CloudTrail	Low
AWS RDS instance modified to allow public access	AWS CloudTrail	Low
AWS RDS instance password changed unexpectedly	AWS CloudTrail	Low
AWS RDS security group created unexpectedly	AWS CloudTrail	Low
AWS RDS snapshot created and made public	AWS CloudTrail	Low
AWS RDS snapshot created manually	AWS CloudTrail	Low
AWS Roles Anywhere profile created	AWS CloudTrail	Low
AWS Route 53 hosted zone associated with a VPC	AWS CloudTrail	Low
AWS Route 53 public hosted zone created unexpectedly	AWS CloudTrail	Low
AWS S3 bucket modified to allow public access	AWS CloudTrail	Low
AWS S3 bucket versioning suspended unexpectedly	AWS CloudTrail	Low
AWS SES GetAccount action invoked via AccessKey	AWS CloudTrail	Low
AWS SES identity deleted	AWS CloudTrail	Low
AWS SES production access granted	AWS CloudTrail	Low
AWS System Manager encrypted parameter retrieved unexpectedly	AWS CloudTrail	Low
AWS WorkMail mailbox exported	AWS CloudTrail	Low
AWS access key created for a newly registered IAM user	AWS CloudTrail	Low
AWS access key created unexpectedly	AWS CloudTrail	Low
AWS access key used to delete itself	AWS CloudTrail	Low
AWS account created unexpectedly	AWS CloudTrail	Low
AWS account password policy changed in an unexpected way	AWS CloudTrail	Low
AWS account password policy deleted	AWS CloudTrail	Low
AWS identity added to an admin group	AWS CloudTrail	Low
AWS network infrastructure modification opening a wide range of ports	AWS CloudTrail	Low
AWS policy contains unsubstituted template values	AWS CloudTrail	Low
AWS policy that allows to perform any action was added	AWS CloudTrail	Low
AWS root account assumed via temporary credentials	AWS CloudTrail	Low
AWS service quota described in multiple regions	AWS CloudTrail	Low
An AWS account removed itself from the organization	AWS CloudTrail	Low
Connection to an AWS EC2 instance using EC2 Instance Connect by a suspicious user	AWS CloudTrail	Low
Connection to multiple AWS EC2 instances using EC2 Instance Connect	AWS CloudTrail	Low
DNS misconfiguration leading to potential compromise	DNS	Low
Encrypted DNS traffic indicating potential infection or evasion	DNS, IP, HTTP	Low
Excessive number of DNS failures requiring investigation	DNS	Low
Excessive number of HTTP failures to an uncommon destination	HTTP	Low
IAM default policy set to an unexpected version	AWS CloudTrail	Low
IAM role attached to an AWS RDS instance unexpectedly	AWS CloudTrail	Low
Malicious pop-up traffic	DNS, HTTP	Low
Many AWS Route 53 domains registered	AWS CloudTrail	Low
Modification of multiple AWS EC2 instance startup scripts	AWS CloudTrail	Low
Multiple AWS API calls executed in dry run mode	AWS CloudTrail	Low
Multiple AWS EC2 instances launched	AWS CloudTrail	Low
Multiple AWS EC2 instances terminated unexpectedly	AWS CloudTrail	Low
Multiple AWS root password recovery requests	AWS CloudTrail	Low
Multiple denied AWS API calls requiring investigation	AWS CloudTrail	Low
Multiple denied AWS S3 API calls requiring investigation	AWS CloudTrail	Low
Multiple requests to unreachable domains	DNS, HTTP	Low
Outbound RDP traffic indicating brute force activity	IP	Low
Outbound SSH traffic indicating brute force activity	IP	Low
Outbound WinRM traffic indicating brute force activity	IP	Low
Registered domain impersonating a known brand	DNS	Low
Several unsuccessful AWS console login attempts for a user	AWS CloudTrail	Low
Several unsuccessful AWS console login attempts from the same IP address	AWS CloudTrail	Low
Successful AWS console login from a new country	AWS CloudTrail	Low
Suspicious HTTP POST request requiring investigation	HTTP	Low
Traffic to a suspicious IP destination	IP	Low
Traffic to a suspicious domain	DNS, HTTP	Low
Traffic to a valid domain impersonating a known brand	DNS, HTTP	Low
Traffic to a web server with an open directory on an unusual port	DNS, IP, HTTP	Low
Traffic to an IP lookup service	DNS, IP, HTTP	Low
Traffic to an unusual DNS resolver	IP	Low
Traffic to an unusual port requiring investigation	IP	Low
Unexpected AWS API call with account access key	AWS CloudTrail	Low
Unexpected AWS API calls by a likely malicious caller	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Low
Unexpected AWS API calls indicating AWS DynamoDB backup restoration	AWS CloudTrail	Low
Unexpected AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating ECS cluster creation	AWS CloudTrail	Low
Unexpected AWS API calls indicating IP set modification	AWS CloudTrail	Low
Unexpected AWS API calls indicating Organizations discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating RDS data destruction	AWS CloudTrail	Low
Unexpected AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 delete operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 write operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating SAML activity	AWS CloudTrail	Low
Unexpected AWS API calls indicating SES discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating STS discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating WAF disassociation	AWS CloudTrail	Low
Unexpected AWS API calls indicating change of IAM user password	AWS CloudTrail	Low
Unexpected AWS API calls indicating command execution via System Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Low
Unexpected AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Low
Unexpected AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Low
Unexpected AWS API calls indicating disruption	AWS CloudTrail	Low
Unexpected AWS API calls indicating evasion	AWS CloudTrail	Low
Unexpected AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of config monitoring	AWS CloudTrail	Low
Unexpected AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Low
Unexpected AWS API calls indicating persistence	AWS CloudTrail	Low
Unexpected AWS API calls indicating privilege escalation	AWS CloudTrail	Low
Unexpected AWS API calls indicating reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating resource enumeration	AWS CloudTrail	Low
Unexpected AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Low
Unexpected AWS API calls indicating unauthorized access	AWS CloudTrail	Low
Unexpected AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Low
Unexpected AWS EC2 instance launch	AWS CloudTrail	Low
Unexpected AWS IAM group deletion	AWS CloudTrail	Low
Unexpected AWS console login	AWS CloudTrail	Low
Unexpected AWS role assumed by a principal	AWS CloudTrail	Low
Unknown dynamic DNS provider traffic	DNS, HTTP	Low
Unknown tunneling provider traffic	DNS, IP, HTTP	Low
Unsuccessful AWS IAM password change attempt	AWS CloudTrail	Low
Unsuccessful attempt to assume AWS root account	AWS CloudTrail	Low
Unusual AWS API calls with root account credentials	AWS CloudTrail	Low
Unusual excessive traffic requiring investigation	IP	Low
User activity from unexpected ASN	AWS CloudTrail	Low
User activity from unexpected country	AWS CloudTrail	Low
AWS AMI Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS API calls by a likely malicious caller	AWS CloudTrail	Informational
AWS API calls indicating AWS Bedrock model invocation	AWS CloudTrail	Informational
AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Informational
AWS API calls indicating ECS cluster creation	AWS CloudTrail	Informational
AWS API calls indicating IP set modification	AWS CloudTrail	Informational
AWS API calls indicating Organizations discovery	AWS CloudTrail	Informational
AWS API calls indicating RDS data destruction	AWS CloudTrail	Informational
AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Informational
AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Informational
AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating S3 delete operations	AWS CloudTrail	Informational
AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating S3 write operations	AWS CloudTrail	Informational
AWS API calls indicating SAML activity	AWS CloudTrail	Informational
AWS API calls indicating SES discovery	AWS CloudTrail	Informational
AWS API calls indicating STS discovery	AWS CloudTrail	Informational
AWS API calls indicating WAF disassociation	AWS CloudTrail	Informational
AWS API calls indicating change of IAM user password	AWS CloudTrail	Informational
AWS API calls indicating command execution via System Manager	AWS CloudTrail	Informational
AWS API calls indicating creation of AWS API Gateway key	AWS CloudTrail	Informational
AWS API calls indicating creation of AWS REST API	AWS CloudTrail	Informational
AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating deletion of AWS Elastic File System	AWS CloudTrail	Informational
AWS API calls indicating deletion of AWS access key	AWS CloudTrail	Informational
AWS API calls indicating discovery using AWS Tagging API	AWS CloudTrail	Informational
AWS API calls indicating disruption	AWS CloudTrail	Informational
AWS API calls indicating evasion	AWS CloudTrail	Informational
AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Informational
AWS API calls indicating modification of AWS Resource Access Manager	AWS CloudTrail	Informational
AWS API calls indicating modification of config monitoring	AWS CloudTrail	Informational
AWS API calls indicating new image being pushed to AWS ECR with latest tag	AWS CloudTrail	Informational
AWS API calls indicating persistence	AWS CloudTrail	Informational
AWS API calls indicating privilege escalation	AWS CloudTrail	Informational
AWS API calls indicating reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating resource enumeration	AWS CloudTrail	Informational
AWS API calls indicating retrieval of AWS sign-in token	AWS CloudTrail	Informational
AWS API calls indicating unauthorized access	AWS CloudTrail	Informational
AWS API calls with root account credentials	AWS CloudTrail	Informational
AWS DataSync task initiated	AWS CloudTrail	Informational
AWS DynamoDB table restored from backup	AWS CloudTrail	Informational
AWS EBS snapshot Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Informational
AWS ElastiCache security group modified	AWS CloudTrail	Informational
AWS GuardDuty threat list modified	AWS CloudTrail	Informational
AWS IAM default policy version set	AWS CloudTrail	Informational
AWS IAM group deleted	AWS CloudTrail	Informational
AWS IAM login profile created	AWS CloudTrail	Informational
AWS IAM login profile modified by a different identity than the owner	AWS CloudTrail	Informational
AWS IAM permission boundary deleted	AWS CloudTrail	Informational
AWS IAM policy modified	AWS CloudTrail	Informational
AWS IAM user created with generic name	AWS CloudTrail	Informational
AWS MFA device disabled	AWS CloudTrail	Informational
AWS MFA device registered	AWS CloudTrail	Informational
AWS RDS Deletion Protection disabled	AWS CloudTrail	Informational
AWS RDS instance password changed	AWS CloudTrail	Informational
AWS RDS security group created	AWS CloudTrail	Informational
AWS Roles Anywhere trust anchor created with an external CA	AWS CloudTrail	Informational
AWS Route 53 domain registered	AWS CloudTrail	Informational
AWS Route 53 domain transfer lock disabled for an account	AWS CloudTrail	Informational
AWS Route 53 domain transfer to an external account	AWS CloudTrail	Informational
AWS Route 53 public hosted zone created	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for a bucket	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS S3 bucket versioning suspended	AWS CloudTrail	Informational
AWS S3 server access logging disabled	AWS CloudTrail	Informational
AWS SES service modified	AWS CloudTrail	Informational
AWS SSO access token created	AWS CloudTrail	Informational
AWS System Manager encrypted parameter retrieved	AWS CloudTrail	Informational
AWS access key created	AWS CloudTrail	Informational
AWS account closed	AWS CloudTrail	Informational
AWS account created	AWS CloudTrail	Informational
AWS account password policy changed	AWS CloudTrail	Informational
AWS role assumed by an external principal with an unexpected user agent	AWS CloudTrail	Informational
AWS root password recovery request	AWS CloudTrail	Informational
AWS security group modification allowing access from any IP address	AWS CloudTrail	Informational
Adversary simulation traffic to a benign destination	DNS, IP, HTTP	Informational
Connection to an AWS EC2 instance using EC2 Instance Connect	AWS CloudTrail	Informational
Encrypted DNS traffic to a common destination	DNS, IP, HTTP	Informational
Enumeration of AWS EC2 instance startup scripts	AWS CloudTrail	Informational
IAM role attached to an AWS RDS instance	AWS CloudTrail	Informational
Long AWS console session	AWS CloudTrail	Informational
Modification of an AWS EC2 instance startup script	AWS CloudTrail	Informational
Outbound traffic over SMB requiring investigation	IP	Informational
Quarantine self applied to AWS credentials	AWS CloudTrail	Informational
Successful AWS console login	AWS CloudTrail	Informational
Successful AWS console logins from different locations in a short period	AWS CloudTrail	Informational
Traffic to a destination TLD commonly associated with malware	DNS, HTTP	Informational
Traffic to a destination with a known HTTP open directory	DNS, IP, HTTP	Informational
Traffic to a link-in-bio destination	DNS, HTTP	Informational
Traffic to a user survey site	AWS CloudTrail	Informational
Traffic to an unknown young domain	DNS, HTTP	Informational
Unsuccessful AWS console login attempt	AWS CloudTrail	Informational