Looks for potential enumeration of AWS buckets via ListBuckets.

Detects when an Elastic Container Service (ECS) Task Definition includes a command to query the credential endpoint. This can indicate a potential adversary adding a backdoor to establish persistence or escalate privileges.

Detects the modification of an EC2 snapshot's permissions to enable access from another account

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

Detects possible suspicious glue development endpoint activity.

Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.

Detects when an user attached a Lambda layer to an existing function to override a library that is in use by the function, where their malicious code could utilize the function's IAM role for AWS API calls. This would give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. Disabling default encryption does not change the encryption status of your existing volumes.

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.

Detects when a EFS Fileshare is modified or deleted. You can't delete a file system that is in use. If the file system has any mount targets, the adversary must first delete them, so deletion of a mount will occur before deletion of a fileshare.

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

Detects the change of database master password. It may be a part of data exfiltration.

Detects the modification of the findings on SecurityHub.

An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. With this alert, it is used to detect anyone is changing password on behalf of other users.

Detects disabling, deleting and updating of a Trail

Detects AWS Config Service disabling

Detects when a EFS Fileshare Mount is modified or deleted. An adversary breaking any file system using the mount target that is being deleted, which might disrupt instances or applications using those mounts.

Identifies when an EKS cluster is created or deleted.

Detects when an ElastiCache security group has been created.

Identifies when an ElastiCache security group has been modified or deleted.

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.

Detects AWS root account usage

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Detects when a user tampers with S3 data management in Amazon Web Services.

Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.

Identifies the suspicious use of GetSessionToken. Tokens could be created and used by attackers to move laterally and escalate privileges.

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.