Attributed metadata history
Up to 100 retained publisher events per page for ef698695b5abbcf31d063dad09a21a1c5a016b81fcaab002718e0db5b772ffe9. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
GuardDuty detected CloudTrail being outright disabled, but did not detect if an attacker with the necessary permissions filtered out all events from CloudTrail via PutEventSelectors, resulting in defenders having no logs to review. AWS fixed this issue by adding a GuardDuty detection that triggers if PutEventSelectors is used to disable all event types.
Fingerprint: 0bbcc7408d9fe5e872d1acaea9aac7d7ba543475310850d18d057fdb1e68b3e1
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c