Difference between revisions of "Datadog SIEM Content Packs for Cloudtrail"
Jump to navigation
Jump to search
| (16 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
* https://docs.datadoghq.com/security/default_rules/#cloudtrail | * https://docs.datadoghq.com/security/default_rules/#cloudtrail | ||
| − | + | cloudtrail [[A user received an anomalous number of AccessDenied errors]] | |
| − | + | cloudtrail [[Additional AWS regions enabled]] | |
| − | cloudtrail A user received an anomalous number of AccessDenied errors | + | cloudtrail [[Amazon EC2 AMI exfiltration attempt by IAM user]] |
| − | cloudtrail Additional AWS regions enabled | + | cloudtrail [[Amazon S3 bucket policy modified]] |
| − | cloudtrail Amazon EC2 AMI exfiltration attempt by IAM user | + | cloudtrail [[Amazon SES enumeration attempt by previously unseen user]] |
| − | cloudtrail Amazon S3 bucket policy modified | + | cloudtrail [[Amazon SES modification attempt]] |
| − | cloudtrail Amazon SES enumeration attempt by previously unseen user | + | cloudtrail [[Amazon SNS enumeration attempt by previously unseen user]] |
| − | cloudtrail Amazon SES modification attempt | + | cloudtrail [[Amazon SNS enumeration in multiple regions using a long-term access key]] |
| − | cloudtrail Amazon SNS enumeration attempt by previously unseen user | + | cloudtrail [[An AWS account attempted to leave the AWS Organization]] |
| − | cloudtrail Amazon SNS enumeration in multiple regions using a long-term access key | + | cloudtrail [[An AWS S3 bucket lifecycle expiration policy was set to disabled]] |
| − | cloudtrail An AWS account attempted to leave the AWS Organization | + | cloudtrail [[An AWS S3 bucket lifecycle policy expiration is set to]] < 90 days |
| − | cloudtrail An AWS S3 bucket lifecycle expiration policy was set to disabled | + | cloudtrail [[An AWS S3 bucket mfaDelete is disabled]] |
| − | cloudtrail An AWS S3 bucket lifecycle policy expiration is set to < 90 days | + | cloudtrail [[An EC2 instance attempted to enumerate S3 bucket]] |
| − | cloudtrail An AWS S3 bucket mfaDelete is disabled | + | cloudtrail [[Anomalous amount of access denied events for AWS EC2 Instance]] |
| − | cloudtrail An EC2 instance attempted to enumerate S3 bucket | + | cloudtrail [[Anomalous amount of Autoscaling Group events]] |
| − | cloudtrail Anomalous amount of access denied events for AWS EC2 Instance | + | cloudtrail [[Anomalous API Gateway API key reads by user]] |
| − | cloudtrail Anomalous amount of Autoscaling Group events | + | cloudtrail [[Anomalous number of assumed roles from user]] |
| − | cloudtrail Anomalous API Gateway API key reads by user | + | cloudtrail [[Anomalous number of S3 buckets accessed]] |
| − | cloudtrail Anomalous number of assumed roles from user | + | cloudtrail [[Anomalous number of secrets retrieved from AWS Secrets Manager]] |
| − | cloudtrail Anomalous number of S3 buckets accessed | + | cloudtrail [[Anomalous S3 bucket activity from user ARN]] |
| − | cloudtrail Anomalous number of secrets retrieved from AWS Secrets Manager | + | cloudtrail [[Attempt to create Xlarge EC2 instances in multiple AWS regions]] |
| − | cloudtrail Anomalous S3 bucket activity from user ARN | + | cloudtrail [[AWS access key creation by previously unseen identity]] |
| − | cloudtrail Attempt to create Xlarge EC2 instances in multiple AWS regions | + | cloudtrail [[AWS AMI Made Public]] |
| − | + | cloudtrail [[AWS CloudTrail configuration modified]] | |
| − | cloudtrail AWS access key creation by previously unseen identity | + | cloudtrail [[AWS CloudTrail trail should have global service events enabled]] |
| − | cloudtrail AWS AMI Made Public | + | cloudtrail [[AWS CloudWatch log group deleted]] |
| − | cloudtrail AWS CloudTrail configuration modified | + | cloudtrail [[AWS CloudWatch rule disabled or deleted]] |
| − | cloudtrail AWS CloudTrail trail should have global service events enabled | + | cloudtrail [[AWS Config modified]] |
| − | cloudtrail AWS CloudWatch log group deleted | + | cloudtrail [[AWS console login without MFA]] |
| − | cloudtrail AWS CloudWatch rule disabled or deleted | + | cloudtrail [[AWS ConsoleLogin with MFA triggered Impossible Travel scenario]] |
| − | cloudtrail AWS Config modified | + | cloudtrail [[AWS ConsoleLogin without MFA triggered Impossible Travel scenario]] |
| − | cloudtrail AWS console login without MFA | + | cloudtrail [[AWS Detective Graph deleted]] |
| − | cloudtrail AWS ConsoleLogin with MFA triggered Impossible Travel scenario | + | cloudtrail [[AWS Disable Cloudtrail with event selectors]] |
| − | cloudtrail AWS ConsoleLogin without MFA triggered Impossible Travel scenario | + | cloudtrail [[AWS EBS default encryption disabled]] |
| − | cloudtrail AWS Detective Graph deleted | + | cloudtrail [[AWS EBS Snapshot Made Public]] |
| − | cloudtrail AWS Disable Cloudtrail with event selectors | + | cloudtrail [[AWS EBS Snapshot possible exfiltration]] |
| − | cloudtrail AWS EBS default encryption disabled | + | cloudtrail [[AWS EC2 new event for application]] |
| − | cloudtrail AWS EBS Snapshot Made Public | + | cloudtrail [[AWS EC2 new event for EKS Node Group]] |
| − | cloudtrail AWS EBS Snapshot possible exfiltration | + | cloudtrail [[AWS EC2 subnet deleted]] |
| − | cloudtrail AWS EC2 new event for application | + | cloudtrail [[AWS ECS cluster deleted]] |
| − | cloudtrail AWS EC2 new event for EKS Node Group | + | cloudtrail [[AWS ECS CreateCluster API calls in multiple regions]] |
| − | cloudtrail AWS EC2 subnet deleted | + | cloudtrail [[AWS EventBridge rule disabled or deleted]] |
| − | cloudtrail AWS ECS cluster deleted | + | cloudtrail [[AWS GuardDuty detector deleted]] |
| − | cloudtrail AWS ECS CreateCluster API calls in multiple regions | + | cloudtrail [[AWS GuardDuty publishing destination deleted]] |
| − | cloudtrail AWS EventBridge rule disabled or deleted | + | cloudtrail [[AWS GuardDuty threat intel set deleted]] |
| − | cloudtrail AWS GuardDuty detector deleted | + | cloudtrail [[AWS IAM activity by S3 browser utility]] |
| − | cloudtrail AWS GuardDuty publishing destination deleted | + | cloudtrail [[AWS IAM activity from EC2 instance]] |
| − | cloudtrail AWS GuardDuty threat intel set deleted | + | cloudtrail [[AWS IAM AdministratorAccess policy was applied to a group]] |
| − | cloudtrail AWS IAM activity by S3 browser utility | + | cloudtrail [[AWS IAM AdministratorAccess policy was applied to a role]] |
| − | cloudtrail AWS IAM activity from EC2 instance | + | cloudtrail [[AWS IAM AdministratorAccess policy was applied to a user]] |
| − | cloudtrail AWS IAM AdministratorAccess policy was applied to a group | + | cloudtrail [[AWS IAM policy modified]] |
| − | cloudtrail AWS IAM AdministratorAccess policy was applied to a role | + | cloudtrail [[AWS IAM Roles Anywhere trust anchor created]] |
| − | cloudtrail AWS IAM AdministratorAccess policy was applied to a user | + | cloudtrail [[AWS IAM User created with AdministratorAccess policy attached]] |
| − | cloudtrail AWS IAM policy modified | + | cloudtrail [[AWS Java_Ghost security group creation attempt]] |
| − | cloudtrail AWS IAM Roles Anywhere trust anchor created | + | cloudtrail [[AWS Kinesis Firehose stream destination modified]] |
| − | cloudtrail AWS IAM User created with AdministratorAccess policy attached | + | cloudtrail [[AWS KMS key deleted or scheduled for deletion]] |
| − | cloudtrail AWS Java_Ghost security group creation attempt | + | cloudtrail [[AWS Lambda function modified by IAM user]] |
| − | cloudtrail AWS Kinesis Firehose stream destination modified | + | cloudtrail [[AWS Lambda function resource-based policy modified by IAM user]] |
| − | cloudtrail AWS KMS key deleted or scheduled for deletion | + | cloudtrail [[AWS Network Access Control List created or modified]] |
| − | cloudtrail AWS Lambda function modified by IAM user | + | cloudtrail [[AWS KMS key deleted or scheduled for deletion]] |
| − | cloudtrail AWS Lambda function resource-based policy modified by IAM user | + | cloudtrail [[AWS Lambda function modified by IAM user]] |
| − | cloudtrail AWS Network Access Control List created or modified | + | cloudtrail [[AWS Lambda function resource-based policy modified by IAM user]] |
| − | cloudtrail AWS KMS key deleted or scheduled for deletion | + | cloudtrail [[AWS Network Access Control List created or modified]] |
| − | cloudtrail AWS Lambda function modified by IAM user | + | cloudtrail [[AWS Network Gateway created or modified]] |
| − | cloudtrail AWS Lambda function resource-based policy modified by IAM user | + | cloudtrail [[AWS principal added to multiple EKS clusters]] |
| − | cloudtrail AWS Network Access Control List created or modified | + | cloudtrail [[AWS principal assigned administrative privileges in an EKS cluster]] |
| − | cloudtrail AWS Network Gateway created or modified | + | cloudtrail [[AWS principal granted access to a EKS cluster then removed]] |
| − | cloudtrail AWS principal added to multiple EKS clusters | + | cloudtrail [[AWS RDS Cluster deleted]] |
| − | cloudtrail AWS principal assigned administrative privileges in an EKS cluster | + | cloudtrail [[AWS root account activity]] |
| − | cloudtrail AWS principal granted access to a EKS cluster then removed | + | cloudtrail [[AWS Route 53 DNS query logging disabled]] |
| − | cloudtrail AWS RDS Cluster deleted | + | cloudtrail [[AWS Route 53 VPC disassociated from query logging configuration]] |
| − | cloudtrail AWS root account activity | + | cloudtrail [[AWS Route Table created or modified]] |
| − | cloudtrail AWS Route 53 DNS query logging disabled | + | cloudtrail [[AWS S3 Bucket ACL made public]] |
| − | cloudtrail AWS Route 53 VPC disassociated from query logging configuration | + | cloudtrail [[AWS S3 Public Access Block removed]] |
| − | cloudtrail AWS Route Table created or modified | + | cloudtrail [[AWS security group created, modified or deleted]] |
| − | cloudtrail AWS S3 Bucket ACL made public | + | cloudtrail [[AWS Security Hub disabled]] |
| − | cloudtrail AWS S3 Public Access Block removed | + | cloudtrail [[AWS SES add verified identity followed by the deletion of the identity]] |
| − | cloudtrail AWS security group created, modified or deleted | + | cloudtrail [[AWS SES discovery attempt by long term access key]] |
| − | cloudtrail AWS Security Hub disabled | + | cloudtrail [[AWS SES email sending enabled in current AWS region]] |
| − | cloudtrail AWS SES add verified identity followed by the deletion of the identity | + | cloudtrail [[AWS VPC created or modified]] |
| − | cloudtrail AWS SES discovery attempt by long term access key | + | cloudtrail [[AWS VPC Flow Log deleted]] |
| − | cloudtrail AWS SES email sending enabled in current AWS region | + | cloudtrail [[AWS WAF traffic blocked by specific rule]] |
| − | cloudtrail AWS VPC created or modified | + | cloudtrail [[AWS WAF traffic blocked by specific rule on multiple IPs]] |
| − | cloudtrail AWS VPC Flow Log deleted | + | cloudtrail [[AWS WAF web access control list deleted]] |
| − | cloudtrail AWS WAF traffic blocked by specific rule | + | cloudtrail [[AWS WAF web access control list modified]] |
| − | cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs | + | cloudtrail [[CloudTrail log file validation should be enabled]] |
| − | cloudtrail AWS WAF web access control list deleted | + | cloudtrail [[CloudTrail logs S3 bucket should not be public accessible]] |
| − | cloudtrail AWS WAF web access control list modified | + | cloudtrail [[CloudTrail logs should be encrypted at rest using KMS CMKs]] |
| − | cloudtrail CloudTrail log file validation should be enabled | + | cloudtrail [[Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment]] |
| − | cloudtrail CloudTrail logs S3 bucket should not be public accessible | + | cloudtrail [[CloudTrail trails should be integrated with CloudWatch Logs]] |
| − | cloudtrail CloudTrail logs should be encrypted at rest using KMS CMKs | + | cloudtrail [[Compromised AWS EC2 Instance]] |
| − | cloudtrail Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment | + | cloudtrail [[Compromised AWS IAM User Access Key]] |
| − | cloudtrail CloudTrail trails should be integrated with CloudWatch Logs | + | cloudtrail [[Encrypted administrator password retrieved for Windows EC2 instance]] |
| − | cloudtrail Compromised AWS EC2 Instance | + | cloudtrail [[New Amazon EC2 Instance type]] |
| − | cloudtrail Compromised AWS IAM User Access Key | + | cloudtrail [[New AWS account seen assuming a role into AWS account]] |
| − | cloudtrail Encrypted administrator password retrieved for Windows EC2 instance | + | cloudtrail [[New Private Repository Container Image detected in AWS ECR]] |
| − | cloudtrail New Amazon EC2 Instance type | + | cloudtrail [[New Public Repository Container Image detected in AWS ECR]] |
| − | cloudtrail New AWS account seen assuming a role into AWS account | + | cloudtrail [[New user seen executing a command in an ECS task]] |
| − | cloudtrail New Private Repository Container Image detected in AWS ECR | + | cloudtrail [[Object-level logging should be enabled for S3 bucket read events]] |
| − | cloudtrail New Public Repository Container Image detected in AWS ECR | + | cloudtrail [[Possible AWS EC2 privilege escalation via the modification of user data]] |
| − | cloudtrail New user seen executing a command in an ECS task | + | cloudtrail [[Possible privilege escalation via AWS login profile manipulation]] |
| − | cloudtrail Object-level logging should be enabled for S3 bucket read events | + | cloudtrail [[Possible RDS Snapshot exfiltration]] |
| − | cloudtrail Possible AWS EC2 privilege escalation via the modification of user data | + | cloudtrail [[Potential administrative port open to the world via AWS security group]] |
| − | cloudtrail Possible privilege escalation via AWS login profile manipulation | + | cloudtrail [[Potential brute force attack on AWS ConsoleLogin]] |
| − | cloudtrail Possible RDS Snapshot exfiltration | + | cloudtrail [[Potential database port open to the world via AWS security group]] |
| − | cloudtrail Potential administrative port open to the world via AWS security group | + | cloudtrail [[S3 bucket access logging should be enabled on the CloudTrail S3 bucket]] |
| − | cloudtrail Potential brute force attack on AWS ConsoleLogin | + | cloudtrail [[S3 bucket write events should have object-level logging enabled]] |
| − | cloudtrail Potential database port open to the world via AWS security group | + | cloudtrail [[Security group open to the world]] |
| − | cloudtrail S3 bucket access logging should be enabled on the CloudTrail S3 bucket | + | cloudtrail [[Temporary AWS security credentials generated for user]] |
| − | cloudtrail S3 bucket write events should have object-level logging enabled | + | cloudtrail [[The AWS managed policy AWSCompromisedKeyQuarantineV2 has been attached]] |
| − | cloudtrail Security group open to the world | + | cloudtrail [[There should be at least one multi-region CloudTrail trail per AWS account]] |
| − | cloudtrail Temporary AWS security credentials generated for user | + | cloudtrail [[Tor client IP address identified within AWS environment]] |
| − | cloudtrail The AWS managed policy AWSCompromisedKeyQuarantineV2 has been attached | + | cloudtrail [[TruffleHog user agent observed in AWS]] |
| − | cloudtrail There should be at least one multi-region CloudTrail trail per AWS account | + | cloudtrail [[Unfamiliar IAM user retrieved a decrypted AWS Systems Manager parameter]] |
| − | cloudtrail Tor client IP address identified within AWS environment | + | cloudtrail [[Unfamiliar IAM user retrieved secret from AWS Secrets Manager]] |
| − | cloudtrail TruffleHog user agent observed in AWS | + | cloudtrail [[Unfamiliar IAM user retrieved SSM parameter]] |
| − | cloudtrail Unfamiliar IAM user retrieved a decrypted AWS Systems Manager parameter | + | cloudtrail [[Unusual AWS enumeration event from EC2 instance]] |
| − | cloudtrail Unfamiliar IAM user retrieved secret from AWS Secrets Manager | + | cloudtrail [[User enumerated AWS Secrets Manager - Anomaly]] |
| − | cloudtrail Unfamiliar IAM user retrieved SSM parameter | + | cloudtrail [[User enumerated AWS Systems Manager parameters - Anomaly]] |
| − | cloudtrail Unusual AWS enumeration event from EC2 instance | + | cloudtrail [[User travel was impossible in AWS CloudTrail IAM log]] |
| − | cloudtrail User enumerated AWS Secrets Manager - Anomaly | + | |
| − | cloudtrail User enumerated AWS Systems Manager parameters - Anomaly | ||
| − | cloudtrail User travel was impossible in AWS CloudTrail IAM log | ||
| − | |||
| − | |||
| − | |||
| − | |||
== See also == | == See also == | ||
| + | * {{Content Packs}} | ||
* {{Cloudtrail}} | * {{Cloudtrail}} | ||
* {{DD SIEM}} | * {{DD SIEM}} | ||
| + | |||
| + | [[Category:SIEM]] | ||
| + | [[Category:Datadog]] | ||
Latest revision as of 12:20, 11 September 2024
cloudtrail A user received an anomalous number of AccessDenied errors cloudtrail Additional AWS regions enabled cloudtrail Amazon EC2 AMI exfiltration attempt by IAM user cloudtrail Amazon S3 bucket policy modified cloudtrail Amazon SES enumeration attempt by previously unseen user cloudtrail Amazon SES modification attempt cloudtrail Amazon SNS enumeration attempt by previously unseen user cloudtrail Amazon SNS enumeration in multiple regions using a long-term access key cloudtrail An AWS account attempted to leave the AWS Organization cloudtrail An AWS S3 bucket lifecycle expiration policy was set to disabled cloudtrail An AWS S3 bucket lifecycle policy expiration is set to < 90 days cloudtrail An AWS S3 bucket mfaDelete is disabled cloudtrail An EC2 instance attempted to enumerate S3 bucket cloudtrail Anomalous amount of access denied events for AWS EC2 Instance cloudtrail Anomalous amount of Autoscaling Group events cloudtrail Anomalous API Gateway API key reads by user cloudtrail Anomalous number of assumed roles from user cloudtrail Anomalous number of S3 buckets accessed cloudtrail Anomalous number of secrets retrieved from AWS Secrets Manager cloudtrail Anomalous S3 bucket activity from user ARN cloudtrail Attempt to create Xlarge EC2 instances in multiple AWS regions cloudtrail AWS access key creation by previously unseen identity cloudtrail AWS AMI Made Public cloudtrail AWS CloudTrail configuration modified cloudtrail AWS CloudTrail trail should have global service events enabled cloudtrail AWS CloudWatch log group deleted cloudtrail AWS CloudWatch rule disabled or deleted cloudtrail AWS Config modified cloudtrail AWS console login without MFA cloudtrail AWS ConsoleLogin with MFA triggered Impossible Travel scenario cloudtrail AWS ConsoleLogin without MFA triggered Impossible Travel scenario cloudtrail AWS Detective Graph deleted cloudtrail AWS Disable Cloudtrail with event selectors cloudtrail AWS EBS default encryption disabled cloudtrail AWS EBS Snapshot Made Public cloudtrail AWS EBS Snapshot possible exfiltration cloudtrail AWS EC2 new event for application cloudtrail AWS EC2 new event for EKS Node Group cloudtrail AWS EC2 subnet deleted cloudtrail AWS ECS cluster deleted cloudtrail AWS ECS CreateCluster API calls in multiple regions cloudtrail AWS EventBridge rule disabled or deleted cloudtrail AWS GuardDuty detector deleted cloudtrail AWS GuardDuty publishing destination deleted cloudtrail AWS GuardDuty threat intel set deleted cloudtrail AWS IAM activity by S3 browser utility cloudtrail AWS IAM activity from EC2 instance cloudtrail AWS IAM AdministratorAccess policy was applied to a group cloudtrail AWS IAM AdministratorAccess policy was applied to a role cloudtrail AWS IAM AdministratorAccess policy was applied to a user cloudtrail AWS IAM policy modified cloudtrail AWS IAM Roles Anywhere trust anchor created cloudtrail AWS IAM User created with AdministratorAccess policy attached cloudtrail AWS Java_Ghost security group creation attempt cloudtrail AWS Kinesis Firehose stream destination modified cloudtrail AWS KMS key deleted or scheduled for deletion cloudtrail AWS Lambda function modified by IAM user cloudtrail AWS Lambda function resource-based policy modified by IAM user cloudtrail AWS Network Access Control List created or modified cloudtrail AWS KMS key deleted or scheduled for deletion cloudtrail AWS Lambda function modified by IAM user cloudtrail AWS Lambda function resource-based policy modified by IAM user cloudtrail AWS Network Access Control List created or modified cloudtrail AWS Network Gateway created or modified cloudtrail AWS principal added to multiple EKS clusters cloudtrail AWS principal assigned administrative privileges in an EKS cluster cloudtrail AWS principal granted access to a EKS cluster then removed cloudtrail AWS RDS Cluster deleted cloudtrail AWS root account activity cloudtrail AWS Route 53 DNS query logging disabled cloudtrail AWS Route 53 VPC disassociated from query logging configuration cloudtrail AWS Route Table created or modified cloudtrail AWS S3 Bucket ACL made public cloudtrail AWS S3 Public Access Block removed cloudtrail AWS security group created, modified or deleted cloudtrail AWS Security Hub disabled cloudtrail AWS SES add verified identity followed by the deletion of the identity cloudtrail AWS SES discovery attempt by long term access key cloudtrail AWS SES email sending enabled in current AWS region cloudtrail AWS VPC created or modified cloudtrail AWS VPC Flow Log deleted cloudtrail AWS WAF traffic blocked by specific rule cloudtrail AWS WAF traffic blocked by specific rule on multiple IPs cloudtrail AWS WAF web access control list deleted cloudtrail AWS WAF web access control list modified cloudtrail CloudTrail log file validation should be enabled cloudtrail CloudTrail logs S3 bucket should not be public accessible cloudtrail CloudTrail logs should be encrypted at rest using KMS CMKs cloudtrail Cloudtrail SecretsManager secret retrieved from AWS CloudShell environment cloudtrail CloudTrail trails should be integrated with CloudWatch Logs cloudtrail Compromised AWS EC2 Instance cloudtrail Compromised AWS IAM User Access Key cloudtrail Encrypted administrator password retrieved for Windows EC2 instance cloudtrail New Amazon EC2 Instance type cloudtrail New AWS account seen assuming a role into AWS account cloudtrail New Private Repository Container Image detected in AWS ECR cloudtrail New Public Repository Container Image detected in AWS ECR cloudtrail New user seen executing a command in an ECS task cloudtrail Object-level logging should be enabled for S3 bucket read events cloudtrail Possible AWS EC2 privilege escalation via the modification of user data cloudtrail Possible privilege escalation via AWS login profile manipulation cloudtrail Possible RDS Snapshot exfiltration cloudtrail Potential administrative port open to the world via AWS security group cloudtrail Potential brute force attack on AWS ConsoleLogin cloudtrail Potential database port open to the world via AWS security group cloudtrail S3 bucket access logging should be enabled on the CloudTrail S3 bucket cloudtrail S3 bucket write events should have object-level logging enabled cloudtrail Security group open to the world cloudtrail Temporary AWS security credentials generated for user cloudtrail The AWS managed policy AWSCompromisedKeyQuarantineV2 has been attached cloudtrail There should be at least one multi-region CloudTrail trail per AWS account cloudtrail Tor client IP address identified within AWS environment cloudtrail TruffleHog user agent observed in AWS cloudtrail Unfamiliar IAM user retrieved a decrypted AWS Systems Manager parameter cloudtrail Unfamiliar IAM user retrieved secret from AWS Secrets Manager cloudtrail Unfamiliar IAM user retrieved SSM parameter cloudtrail Unusual AWS enumeration event from EC2 instance cloudtrail User enumerated AWS Secrets Manager - Anomaly cloudtrail User enumerated AWS Systems Manager parameters - Anomaly cloudtrail User travel was impossible in AWS CloudTrail IAM log
See also[edit]
Advertising:
