Detection rules › By event

AWS-ec2

Event	Rules
AssociateIamInstanceProfile	2
AuthorizeSecurityGroupEgress	5
AuthorizeSecurityGroupIngress	8
CreateInstanceExportTask	3
CreateKeyPair	1
CreateNetworkAcl	2
CreateNetworkAclEntry	8
CreateRoute	2
CreateRouteTable	3
CreateSecurityGroup	3
CreateStoreImageTask	2
CreateTrafficMirrorSession	2
DeleteFlowLogs	8
DeleteNetworkAcl	2
DeleteNetworkAclEntry	4
DeleteRoute	1
DeleteRouteTable	2
DescribeImages	1
DescribeInstanceAttribute	1
DescribeInstances	2
DescribeRegions	1
DescribeSecurityGroups	2
DescribeSnapshotAttribute	1
DescribeVpcs	1
DisableEbsEncryptionByDefault	4
DisassociateRouteTable	2
EnableSerialConsoleAccess	1
ExportImage	1
GetPasswordData	6
ImportKeyPair	1
ModifyImageAttribute	3
ModifyInstanceAttribute	7
ModifySecurityGroupRules	1
ModifySnapshotAttribute	8
ReplaceNetworkAclEntry	5
ReplaceRoute	2
ReplaceRouteTableAssociation	2
RevokeSecurityGroupEgress	4
RevokeSecurityGroupIngress	4
StartInstances	2
StopInstances	3
AcceptVpcPeeringConnection	1
AssociateInstanceEventWindow	1
AttachClassicLinkVpc	1
AttachInternetGateway	1
BundleInstance	1
CancelSpotInstanceRequests	1
ConfirmProductInstance	1
CopyFpgaImage	1
CopyImage	1
CreateCustomerGateway	1
CreateFpgaImage	1
CreateImage	1
CreateInstanceEventWindow	1
CreateInternetGateway	2
CreateLaunchTemplate	1
CreateNatGateway	1
CreateRestoreImageTask	1
CreateTrafficMirrorFilter	1
CreateTrafficMirrorFilterRule	1
CreateTrafficMirrorTarget	1
CreateVpc	1
DeleteCustomerGateway	1
DeleteInstanceEventWindow	1
DeleteInternetGateway	1
DeleteSecurityGroup	1
DeleteTrafficMirrorFilter	1
DeleteTrafficMirrorFilterRule	1
DeleteTrafficMirrorSession	1
DeleteTrafficMirrorTarget	1
DeleteVpc	1
DeregisterInstanceEventNotificationAttributes	1
DescribeSecurityGroupReferences	1
DescribeSecurityGroupRules	1
DescribeSubnets	1
DetachClassicLinkVpc	1
DetachInternetGateway	1
DisableVpcClassicLink	1
DisassociateIamInstanceProfile	1
DisassociateInstanceEventWindow	1
EnableVpcClassicLink	1
ImportImage	1
ImportInstance	1
ModifyInstanceCapacityReservationAttributes	1
ModifyInstanceCreditSpecification	1
ModifyInstanceEventStartTime	1
ModifyInstanceEventWindow	1
ModifyInstanceMaintenanceOptions	1
ModifyInstanceMetadataOptions	1
ModifyInstancePlacement	1
ModifyTrafficMirrorFilterNetworkServices	1
ModifyTrafficMirrorFilterRule	1
ModifyTrafficMirrorSession	1
ModifyVpcAttribute	1
MonitorInstances	1
RegisterInstanceEventNotificationAttributes	1
RejectVpcPeeringConnection	1
ReplaceNetworkAclAssociation	1
ReportInstanceStatus	1
RequestSpotInstances	1
ResetInstanceAttribute	1
RunInstances	4
RunScheduledInstances	1
TerminateInstances	1
UnmonitorInstances	1

AssociateIamInstanceProfile

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Instance Profile Associated with Running Instance severity high T1078, T1078.004, T1548, T1548.005

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

AuthorizeSecurityGroupEgress

5 detection rules reference this event. View event page.

Sigma (1)

Ingress/Egress Security Group Modification severity medium T1190

Elastic (1)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001

Kusto (1)

AWSCloudTrail - Changes to AWS Security Group ingress and egress settings severity low T1685, T1686.001

Panther (2)

AWS EC2 Manual Security Group Change severity medium T1685
EC2 Security Group Modified severity informational T1685

AuthorizeSecurityGroupIngress

8 detection rules reference this event. View event page.

Sigma (2)

Ingress Port 22 Opened severity medium
Ingress/Egress Security Group Modification severity medium T1190

Elastic (2)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001
Insecure AWS EC2 VPC Security Group Ingress Rule Added severity medium T1133, T1685, T1686.001

Kusto (1)

AWSCloudTrail - Changes to AWS Security Group ingress and egress settings severity low T1685, T1686.001

YARA-L (1)

AWS Security Group Open To The World severity high T1685

Panther (2)

AWS EC2 Manual Security Group Change severity medium T1685
EC2 Security Group Modified severity informational T1685

CreateInstanceExportTask

3 detection rules reference this event. View event page.

Sigma (1)

AWS EC2 VM Export Failure severity low T1005, T1537

Elastic (1)

AWS EC2 Export Task severity medium T1005, T1119, T1530, T1537, T1567, T1567.002

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

CreateKeyPair

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization severity high T1021, T1021.004, T1098, T1552, T1552.004

CreateNetworkAcl

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Network Access Control List Creation severity low T1133, T1578, T1578.005, T1685, T1686.001

Panther (1)

EC2 Network ACL Modified severity informational T1685

CreateNetworkAclEntry

8 detection rules reference this event. View event page.

Sigma (1)

New Network ACL Entry Added severity low T1686, T1686.001

Elastic (2)

AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity severity medium T1685, T1686.001
AWS EC2 Network Access Control List Creation severity low T1133, T1578, T1578.005, T1685, T1686.001

Splunk (2)

ASL AWS Network Access Control List Created with All Open Ports severity medium T1686, T1686.001
AWS Network Access Control List Created with All Open Ports severity medium T1686, T1686.001

Kusto (2)

AWSCloudTrail - Changes to Amazon VPC settings severity low T1078, T1685, T1686.001
AWSCloudTrail - Network ACL with all the open ports to a specified CIDR severity high T1685, T1686.001

Panther (1)

EC2 Network ACL Modified severity informational T1685

CreateRoute

2 detection rules reference this event. View event page.

Sigma (1)

New Network Route Added severity medium T1686, T1686.001

Elastic (1)

AWS EC2 Route Table Created severity low T1578, T1578.005

CreateRouteTable

3 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Created severity low T1578, T1578.005

Kusto (1)

AWSCloudTrail - Changes to Amazon VPC settings severity low T1078, T1685, T1686.001

Panther (1)

EC2 Route Table Modified severity informational T1048

CreateSecurityGroup

3 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001

Panther (2)

AWS EC2 Manual Security Group Change severity medium T1685
EC2 Security Group Modified severity informational T1685

CreateStoreImageTask

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Export Task severity medium T1005, T1119, T1530, T1537, T1567, T1567.002

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CreateTrafficMirrorSession

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Full Network Packet Capture Detected severity medium T1020, T1040, T1074, T1537

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

DeleteFlowLogs

8 detection rules reference this event. View event page.

Sigma (1)

AWS VPC Flow Logs Deleted severity high

Elastic (1)

AWS VPC Flow Logs Deletion severity high T1685, T1685.002

Kusto (3)

AWSCloudTrail - Changes made to AWS CloudTrail logs severity low T1070
AWSCloudTrail - Config Service Resource Deletion Attempts severity low T1685, T1685.002
AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002

YARA-L (1)

AWS Delete VPC Flow Logs severity low T1685, T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
AWS VPC Flow Logs Removed severity informational T1685.002

DeleteNetworkAcl

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Network Access Control List Deletion severity medium T1685, T1686.001

Panther (1)

EC2 Network ACL Modified severity informational T1685

DeleteNetworkAclEntry

4 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Network Access Control List Deletion severity medium T1685, T1686.001

Splunk (2)

ASL AWS Network Access Control List Deleted severity low T1686, T1686.001
AWS Network Access Control List Deleted severity low T1686, T1686.001

Panther (1)

EC2 Network ACL Modified severity informational T1685

DeleteRoute

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Modified or Deleted severity low T1578, T1578.005

DeleteRouteTable

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Modified or Deleted severity low T1578, T1578.005

Panther (1)

EC2 Route Table Modified severity informational T1048

DescribeImages

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Deprecated AMI Discovery severity low T1580

DescribeInstanceAttribute

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 User Data Retrieval for EC2 Instance severity medium T1552, T1552.005, T1580

DescribeInstances

2 detection rules reference this event. View event page.

Elastic (2)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580
AWS EC2 Multi-Region DescribeInstances API Calls severity low building block T1580

DescribeRegions

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

DescribeSecurityGroups

2 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

Panther (1)

AWS Software Discovery severity informational T1518

DescribeSnapshotAttribute

1 detection rules reference this event. View event page.

Splunk (1)

AWS Exfiltration via EC2 Snapshot severity medium T1537

DescribeVpcs

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

DisableEbsEncryptionByDefault

4 detection rules reference this event. View event page.

Sigma (1)

AWS EC2 Disable EBS Encryption severity medium T1486, T1565

Elastic (1)

AWS EC2 Encryption Disabled severity medium T1565, T1565.001, T1578, T1578.005

Panther (2)

Account Security Configuration Changed severity medium T1685
AWS EC2 EBS Encryption Disabled severity medium T1486, T1565

DisassociateRouteTable

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Modified or Deleted severity low T1578, T1578.005

Panther (1)

EC2 Route Table Modified severity informational T1048

EnableSerialConsoleAccess

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Serial Console Access Enabled severity high T1578, T1578.005, T1685

ExportImage

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Export Task severity medium T1005, T1119, T1530, T1537, T1567, T1567.002

GetPasswordData

6 detection rules reference this event. View event page.

Sigma (1)

EC2 Password Data Retrieved severity low T1555

Elastic (1)

AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role severity medium T1078, T1078.004, T1552, T1552.005

Splunk (2)

ASL AWS Credential Access GetPasswordData severity low T1110, T1110.001, T1586, T1586.003
AWS Credential Access GetPasswordData severity low T1110, T1110.001, T1586, T1586.003

YARA-L (1)

AWS EC2 Get Windows Admin Password severity high T1555

Panther (1)

AWS EC2 Many Password Read Attempts severity informational T1555

ImportKeyPair

1 detection rules reference this event. View event page.

Sigma (1)

AWS Key Pair Import Activity severity medium T1078

ModifyImageAttribute

3 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 AMI Shared with Another Account severity high T1537

Splunk (1)

AWS AMI Attribute Modification for Exfiltration severity medium T1537

YARA-L (1)

AWS EC2 AMI Or Snapshot Shared Publicly severity high T1537

ModifyInstanceAttribute

7 detection rules reference this event. View event page.

Sigma (1)

AWS EC2 Startup Shell Script Change severity high T1059, T1059.001, T1059.003, T1059.004

Elastic (2)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001
AWS EC2 Stop, Start, and User Data Modification Correlation severity high T1059, T1059.009, T1578

Kusto (1)

AWSCloudTrail - EC2 Startup Shell Script Changed severity medium T1059

YARA-L (1)

AWS EC2 User Data Modified severity high T1037

Panther (2)

AWS EC2 Startup Script Change severity high T1059
AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifySecurityGroupRules

1 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001

ModifySnapshotAttribute

8 detection rules reference this event. View event page.

Sigma (1)

AWS Snapshot Backup Exfiltration severity medium T1537

Elastic (2)

AWS EC2 EBS Snapshot Access Removed severity medium T1485, T1490, T1578, T1578.005
AWS EC2 EBS Snapshot Shared or Made Public severity medium T1537

Splunk (3)

ASL AWS EC2 Snapshot Shared Externally severity medium T1537
AWS EC2 Snapshot Shared Externally severity medium T1537
AWS Exfiltration via EC2 Snapshot severity medium T1537

YARA-L (1)

AWS EC2 AMI Or Snapshot Shared Publicly severity high T1537

Panther (1)

AWS Snapshot Made Public severity medium T1537

ReplaceNetworkAclEntry

5 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity severity medium T1685, T1686.001

Splunk (2)

ASL AWS Network Access Control List Created with All Open Ports severity medium T1686, T1686.001
AWS Network Access Control List Created with All Open Ports severity medium T1686, T1686.001

Kusto (1)

AWSCloudTrail - Network ACL with all the open ports to a specified CIDR severity high T1685, T1686.001

Panther (1)

EC2 Network ACL Modified severity informational T1685

ReplaceRoute

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Modified or Deleted severity low T1578, T1578.005

Panther (1)

EC2 Route Table Modified severity informational T1048

ReplaceRouteTableAssociation

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Route Table Modified or Deleted severity low T1578, T1578.005

Panther (1)

EC2 Route Table Modified severity informational T1048

RevokeSecurityGroupEgress

4 detection rules reference this event. View event page.

Sigma (1)

Ingress/Egress Security Group Modification severity medium T1190

Elastic (1)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001

Kusto (1)

AWSCloudTrail - Changes to AWS Security Group ingress and egress settings severity low T1685, T1686.001

Panther (1)

EC2 Security Group Modified severity informational T1685

RevokeSecurityGroupIngress

4 detection rules reference this event. View event page.

Sigma (1)

Ingress/Egress Security Group Modification severity medium T1190

Elastic (1)

AWS EC2 Security Group Configuration Change severity low T1133, T1578, T1578.005, T1685, T1686.001

Kusto (1)

AWSCloudTrail - Changes to AWS Security Group ingress and egress settings severity low T1685, T1686.001

Panther (1)

EC2 Security Group Modified severity informational T1685

StartInstances

2 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Stop, Start, and User Data Modification Correlation severity high T1059, T1059.009, T1578

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

StopInstances

3 detection rules reference this event. View event page.

Elastic (1)

AWS EC2 Stop, Start, and User Data Modification Correlation severity high T1059, T1059.009, T1578

Panther (2)

AWS Modify Cloud Compute Infrastructure severity medium T1578
CloudTrail EC2 StopInstances severity informational

AcceptVpcPeeringConnection

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

AssociateInstanceEventWindow

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

AttachClassicLinkVpc

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

AttachInternetGateway

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network Gateway Modified severity informational T1685

BundleInstance

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

CancelSpotInstanceRequests

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ConfirmProductInstance

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

CopyFpgaImage

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CopyImage

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CreateCustomerGateway

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network Gateway Modified severity informational T1685

CreateFpgaImage

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CreateImage

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CreateInstanceEventWindow

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

CreateInternetGateway

2 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - Changes to Amazon VPC settings severity low T1078, T1685, T1686.001

Panther (1)

EC2 Network Gateway Modified severity informational T1685

CreateLaunchTemplate

1 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - EC2 Startup Shell Script Changed severity medium T1059

CreateNatGateway

1 detection rules reference this event. View event page.

Kusto (1)

AWSCloudTrail - Changes to Amazon VPC settings severity low T1078, T1685, T1686.001

CreateRestoreImageTask

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

CreateTrafficMirrorFilter

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

CreateTrafficMirrorFilterRule

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

CreateTrafficMirrorTarget

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

CreateVpc

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

DeleteCustomerGateway

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network Gateway Modified severity informational T1685

DeleteInstanceEventWindow

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

DeleteInternetGateway

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network Gateway Modified severity informational T1685

DeleteSecurityGroup

1 detection rules reference this event. View event page.

Panther (1)

EC2 Security Group Modified severity informational T1685

DeleteTrafficMirrorFilter

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

DeleteTrafficMirrorFilterRule

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

DeleteTrafficMirrorSession

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

DeleteTrafficMirrorTarget

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

DeleteVpc

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

DeregisterInstanceEventNotificationAttributes

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

DescribeSecurityGroupReferences

1 detection rules reference this event. View event page.

Panther (1)

AWS Software Discovery severity informational T1518

DescribeSecurityGroupRules

1 detection rules reference this event. View event page.

Panther (1)

AWS Software Discovery severity informational T1518

DescribeSubnets

1 detection rules reference this event. View event page.

Panther (1)

AWS Software Discovery severity informational T1518

DetachClassicLinkVpc

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

DetachInternetGateway

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network Gateway Modified severity informational T1685

DisableVpcClassicLink

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

DisassociateIamInstanceProfile

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

DisassociateInstanceEventWindow

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

EnableVpcClassicLink

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

ImportImage

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Image Monitoring severity informational T1204

ImportInstance

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceCapacityReservationAttributes

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceCreditSpecification

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceEventStartTime

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceEventWindow

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceMaintenanceOptions

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstanceMetadataOptions

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyInstancePlacement

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ModifyTrafficMirrorFilterNetworkServices

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

ModifyTrafficMirrorFilterRule

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

ModifyTrafficMirrorSession

1 detection rules reference this event. View event page.

Panther (1)

AWS EC2 Traffic Mirroring severity medium T1040

ModifyVpcAttribute

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

MonitorInstances

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

RegisterInstanceEventNotificationAttributes

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

RejectVpcPeeringConnection

1 detection rules reference this event. View event page.

Panther (1)

EC2 VPC Modified severity informational T1685

ReplaceNetworkAclAssociation

1 detection rules reference this event. View event page.

Panther (1)

EC2 Network ACL Modified severity informational T1685

ReportInstanceStatus

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

RequestSpotInstances

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

ResetInstanceAttribute

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

RunInstances

4 detection rules reference this event. View event page.

Kusto (2)

AWSCloudTrail - Suspicious AWS EC2 Compute Resource Deployments severity medium T1496
AWSCloudTrail - Unauthorized EC2 Instance Setup Attempt severity medium T1583

Panther (2)

AWS EC2 Launch Unusual EC2 Instances severity informational T1610
AWS Modify Cloud Compute Infrastructure severity medium T1578

RunScheduledInstances

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

TerminateInstances

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578

UnmonitorInstances

1 detection rules reference this event. View event page.

Panther (1)

AWS Modify Cloud Compute Infrastructure severity medium T1578