Threat Hunt

Saved Queries

Root API activity (30d)

All CloudTrail events from root account in last 30 days

SQL Editor·cloudtrail_events · stratos-archive

Results

Run the query to see results

Live

5s agoCTiam:CreateAccessKey — root@941230001 (us-east-1)·18s agoGDTrojan:EC2/CryptoMiner — i-0a4b7c8d9e (us-east-1)·45s agoCTiam:AttachRolePolicy — ci-deploy + AdministratorAccess·1m agoMCSensitiveData:S3Object/Personal — 12 objects in audit-logs-prod·2m agoCTs3:PutBucketAcl — ml-training-data set to public-read·3m agoSHCIS 1.14 — Hardware MFA not enabled for root·5s agoCTiam:CreateAccessKey — root@941230001 (us-east-1)·18s agoGDTrojan:EC2/CryptoMiner — i-0a4b7c8d9e (us-east-1)·45s agoCTiam:AttachRolePolicy — ci-deploy + AdministratorAccess·1m agoMCSensitiveData:S3Object/Personal — 12 objects in audit-logs-prod·2m agoCTs3:PutBucketAcl — ml-training-data set to public-read·3m agoSHCIS 1.14 — Hardware MFA not enabled for root·