Authentication

Detect AWS Console Login by User from New Region

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New Country

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New City

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

AWS Credential Access Failed Login

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

Potential password in username

Local Accounts, Credentials In Files

Detect AWS Console Login by New User

Compromise Accounts, Cloud Accounts, Unsecured Credentials

Potential Pass the Token or Hash Observed at the Destination Device

Use Alternate Authentication Material, Pass the Hash

Potential Pass the Token or Hash Observed by an Event Collecting Device

Use Alternate Authentication Material, Pass the Hash

AWS Cross Account Activity From Previously Unseen Account

Detect New Login Attempts to Routers