Hubbsters Security Hub findings report

Run 2026/09/01 · 4 accounts · 64 findings · s3://example-logging-bucket/SecurityHubReports/2026/09/01/Hubbsters-Security-Hub-Findings.xlsx

Sample output. Account IDs are placeholders and every finding comes from the GuardDuty sample finding set, so titles reference i-99999999 and GeneratedFinding* resources. The real report is an Excel workbook with the same two sheets; this page is a rendering of it.

Notification

Security Hub report ready for Hubbsters (with failures)
Accounts: 2 succeeded, 2 failed of 4
Findings: 64
S3 path: s3://example-logging-bucket/SecurityHubReports/2026/09/01/Hubbsters-Security-Hub-Findings.xlsx
Download: aws s3 cp s3://example-logging-bucket/SecurityHubReports/2026/09/01/Hubbsters-Security-Hub-Findings.xlsx .
Failed accounts: 777788889999, 123456789012

Summary sheet

AccountIdStatusCRITICALHIGHMEDIUMLOWINFORMATIONALTotalErrors
111122223333ok2111610039
444455556666ok0705012
777788889999partial0076013us-west-2: An error occurred (InvalidAccessException) when calling the GetFindings operation: Account 777788889999 is not subscribed to AWS Security Hub
123456789012error000000assume_role: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::999999999999:assumed-role/Hubbsters-securityhub-collect/collect is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/SecurityHubReadOnlyCrossAccount

Findings sheet

CustomerNameRegionAccountIdTitleProductNameSeverityResourceTypeResourceIdRelatedRequirements
Hubbstersus-east-1111122223333Potentially compromised credentials were used in a sequence of actions by GeneratedFindingUserName.GuardDutyCRITICALAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Data was potentially compromised in S3 bucket GeneratedFindingS3Bucket in a sequence of actions.GuardDutyCRITICALAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-east-1111122223333EC2 instance i-99999999 is querying a domain name associated with a known Command & Control server.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is querying a domain name that is associated with Bitcoin-related activity.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is behaving in a manner that may indicate it is being used to perform a Denial of Service (DoS) attack using the DNS protocol.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is exfiltrating data through DNS queries.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is making connections to a Tor Guard or an Authority node.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333Malicious file(s) found on EC2 instance i-99999999.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333Credentials created exclusively for an EC2 instance using instance role GeneratedFindingUserName have been used from an external IP address.GuardDutyHIGHAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Anonymous API access was granted for EKS cluster GeneratedFindingEKSClusterName.GuardDutyHIGHAwsEksClusterarn:aws:eks:us-east-1:111122223333:cluster/GeneratedFindingEKSClusterName
Hubbstersus-east-1111122223333Lambda function GeneratedFindingLambdaFunctionName is querying a domain name associated with Bitcoin-related activity.GuardDutyHIGHAwsLambdaFunctionarn:aws:lambda:us-east-1:111122223333:function:GeneratedFindingLambdaFunctionName
Hubbstersus-east-1111122223333Successful brute force login attempts against RDS database GeneratedFindingDBInstanceId were observed.GuardDutyHIGHAwsRdsDbInstancearn:aws:rds:us-east-1:111122223333:db:GeneratedFindingDBInstanceId
Hubbstersus-east-1111122223333Data was exfiltrated from S3 bucket GeneratedFindingS3Bucket from a known malicious IP address.GuardDutyHIGHAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-east-1444455556666EC2 instance i-99999999 is querying a domain name associated with a known Command & Control server.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 is querying a domain name that is associated with Bitcoin-related activity.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 is behaving in a manner that may indicate it is being used to perform a Denial of Service (DoS) attack using the DNS protocol.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 is exfiltrating data through DNS queries.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 is making connections to a Tor Guard or an Authority node.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666Malicious file(s) found on EC2 instance i-99999999.GuardDutyHIGHAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666Credentials created exclusively for an EC2 instance using instance role GeneratedFindingUserName have been used from an external IP address.GuardDutyHIGHAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333EC2 instance i-99999999 is performing outbound port scans against remote host 198.51.100.0.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is communicating with a disallowed IP address on a custom threat list.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 is communicating with a remote host on an unusual server port 8080.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333A new binary was executed on EC2 instance i-99999999.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333API GeneratedFindingAPIName was invoked from a Tor exit node IP address.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333API GeneratedFindingAPIName was invoked from a Kali Linux machine.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Multiple worldwide successful console logins were observed for user GeneratedFindingUserName.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333S3 API GeneratedFindingAPIName was invoked from a Tor exit node IP address.GuardDutyMEDIUMAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-west-2111122223333EC2 instance i-99999999 is performing outbound port scans against remote host 198.51.100.0.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-west-2:111122223333:instance/i-99999999
Hubbstersus-west-2111122223333EC2 instance i-99999999 is communicating with a disallowed IP address on a custom threat list.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-west-2:111122223333:instance/i-99999999
Hubbstersus-west-2111122223333EC2 instance i-99999999 is communicating with a remote host on an unusual server port 8080.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-west-2:111122223333:instance/i-99999999
Hubbstersus-west-2111122223333A new binary was executed on EC2 instance i-99999999.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-west-2:111122223333:instance/i-99999999
Hubbstersus-west-2111122223333API GeneratedFindingAPIName was invoked from a Tor exit node IP address.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-west-2111122223333API GeneratedFindingAPIName was invoked from a Kali Linux machine.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-west-2111122223333Multiple worldwide successful console logins were observed for user GeneratedFindingUserName.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-west-2111122223333S3 API GeneratedFindingAPIName was invoked from a Tor exit node IP address.GuardDutyMEDIUMAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-east-1777788889999EC2 instance i-99999999 is performing outbound port scans against remote host 198.51.100.0.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:777788889999:instance/i-99999999
Hubbstersus-east-1777788889999EC2 instance i-99999999 is communicating with a disallowed IP address on a custom threat list.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:777788889999:instance/i-99999999
Hubbstersus-east-1777788889999EC2 instance i-99999999 is communicating with a remote host on an unusual server port 8080.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:777788889999:instance/i-99999999
Hubbstersus-east-1777788889999A new binary was executed on EC2 instance i-99999999.GuardDutyMEDIUMAwsEc2Instancearn:aws:ec2:us-east-1:777788889999:instance/i-99999999
Hubbstersus-east-1777788889999API GeneratedFindingAPIName was invoked from a Tor exit node IP address.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999API GeneratedFindingAPIName was invoked from a Kali Linux machine.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999Multiple worldwide successful console logins were observed for user GeneratedFindingUserName.GuardDutyMEDIUMAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Unprotected port on EC2 instance i-99999999 is being probed.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 has been involved in RDP brute force attacks.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333EC2 instance i-99999999 has been involved in SSH brute force attacks.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:111122223333:instance/i-99999999
Hubbstersus-east-1111122223333AWS CloudTrail trail GeneratedFindingCloudTrailName was disabled.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333The password policy of account 111122223333 was weakened.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Root user credentials were used to invoke API GeneratedFindingAPIName.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333APIs commonly used to discover resources were invoked by IAM user GeneratedFindingUserName in an anomalous way.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1111122223333Amazon S3 Block Public Access was disabled for S3 bucket GeneratedFindingS3Bucket.GuardDutyLOWAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-east-1111122223333S3 server access logging was disabled for bucket GeneratedFindingS3Bucket.GuardDutyLOWAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-west-2111122223333Unprotected port on EC2 instance i-99999999 is being probed.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-west-2:111122223333:instance/i-99999999
Hubbstersus-east-1444455556666Unprotected port on EC2 instance i-99999999 is being probed.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 has been involved in RDP brute force attacks.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666EC2 instance i-99999999 has been involved in SSH brute force attacks.GuardDutyLOWAwsEc2Instancearn:aws:ec2:us-east-1:444455556666:instance/i-99999999
Hubbstersus-east-1444455556666AWS CloudTrail trail GeneratedFindingCloudTrailName was disabled.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1444455556666The password policy of account 444455556666 was weakened.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999AWS CloudTrail trail GeneratedFindingCloudTrailName was disabled.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999The password policy of account 777788889999 was weakened.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999Root user credentials were used to invoke API GeneratedFindingAPIName.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999APIs commonly used to discover resources were invoked by IAM user GeneratedFindingUserName in an anomalous way.GuardDutyLOWAwsIamAccessKeyAWS::IAM::AccessKey:GeneratedFindingAccessKeyId
Hubbstersus-east-1777788889999Amazon S3 Block Public Access was disabled for S3 bucket GeneratedFindingS3Bucket.GuardDutyLOWAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket
Hubbstersus-east-1777788889999S3 server access logging was disabled for bucket GeneratedFindingS3Bucket.GuardDutyLOWAwsS3Bucketarn:aws:s3:::GeneratedFindingS3Bucket