Authentication

Detect AWS Console Login by New User

Potential Pass the Token or Hash Observed at the Destination Device

Use Alternate Authentication Material, Pass the Hash

Potential Pass the Token or Hash Observed by an Event Collecting Device

Use Alternate Authentication Material, Pass the Hash

Detect AWS Console Login by User from New Region

Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New Country

Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New City

Unused/Unsupported Cloud Regions

Detect AWS Console Login by New User

AWS Cross Account Activity From Previously Unseen Account

Detect New Login Attempts to Routers