Detect AWS Console Login by User from New City

Unused/Unsupported Cloud Regions

Detect Computer Changed with Anonymous Account

Exploitation of Remote Services

Create or delete windows shares using net exe

Indicator Removal on Host , Network Share Connection Removal

Detect Zerologon via Zeek

Exploit Public-Facing Application

Cloud Compute Instance Created With Previously Unseen Instance Type