Skip to content
Threat Feed
Subscribe

Product

AWS CloudWatch

3 briefs RSS
medium advisory

Detection of Internal Horizontal Port Scanning Activity

Detection logic identifying internal hosts performing broad network reconnaissance by scanning 250+ unique IP addresses across NMAP's top 20 common ports.

AWS CloudWatch +1 reconnaissance network-discovery internal-scanning nmap
1r 1t
high advisory

AWS Security Services Impairment via Deletion Operations

Attackers attempt to impair or disable AWS security services such as GuardDuty, WAF, CloudWatch, Route 53 and CloudWatch Logs by deleting detectors, rule groups, IP sets, web ACLs, logging configurations, alarms and log streams, in order to evade detection and operate undetected.

AWS GuardDuty +4 aws cloudtrail defense-evasion
3r 1t
high advisory

AWS CloudWatch Log Group Deletion for Defense Evasion

The deletion of AWS CloudWatch log groups, detected via CloudTrail logs, indicates a potential defense evasion attempt by adversaries aiming to remove audit trails and hinder incident response.

AWS CloudWatch cloud aws defense-evasion
2r 1t