| elastic |
First-Time FortiGate Administrator Login |
production |
2026-09-28 |
| elastic |
FortiGate FortiCloud SSO Login from Unusual Source |
production |
2026-09-28 |
| elastic |
Newly Observed High Severity Detection Alert |
production |
2026-09-28 |
| elastic |
Unusual Azure VM Extension Detected |
production |
2026-09-28 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-09-28 |
| elastic |
Newly Observed Elastic Defend Behavior Alert |
production |
2026-09-28 |
| elastic |
Potential NetScaler Log Poisoning Command Injection Attempt |
production |
2026-09-28 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-09-28 |
| elastic |
Potential TerminalFix Cloudflare Lure in PowerShell |
production |
2026-09-28 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Microsoft Defender XDR Incident External Alerts |
production |
2026-09-28 |
| elastic |
AWS Lambda Function Deletion by Unusual User |
production |
2026-09-28 |
| elastic |
AWS Lambda Function Invoked by an Unusual Principal |
production |
2026-09-28 |
| elastic |
AWS Backup Recovery Point Deleted by Unusual User |
production |
2026-09-28 |
| sigma |
Uncommon Child Process Spawned From XBootMgrSleep.EXE |
experimental |
2026-09-27 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| sigma |
Azure Subscription Permission Elevation Via AuditLogs |
test |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| elastic |
Anthropic Compliance Audit Log Export Accessed |
production |
2026-09-25 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-09-25 |
| elastic |
Anthropic Multiple Authentication Failures |
production |
2026-09-25 |
| elastic |
Anthropic Session Reuse Impossible Travel |
production |
2026-09-25 |
| elastic |
Correlated Alerts on Similar User Identities |
production |
2026-09-25 |
| elastic |
LLM-Based Attack Chain Triage by Host |
production |
2026-09-25 |
| elastic |
Anthropic High File Upload Activity |
production |
2026-09-25 |
| elastic |
Anthropic SSO Disabled or Connection Removed |
production |
2026-09-25 |
| elastic |
Unusual High Word Policy Blocks Detected |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
Anthropic Organization IP Restriction Deleted |
production |
2026-09-25 |