| elastic |
Azure Key Vault Excessive Secret or Key Retrieved |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Writing Suspicious Files |
production |
2026-09-18 |
| elastic |
Potential NetNTLMv1 Downgrade Attack |
production |
2026-09-18 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Execution from INET Cache |
production |
2026-09-18 |
| elastic |
Suspicious WerFault Child Process |
production |
2026-09-18 |
| elastic |
WMI Incoming Lateral Movement |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-09-18 |
| elastic |
Mshta Making Network Connections |
production |
2026-09-18 |
| elastic |
PowerShell Obfuscation via Negative Index String Reversal |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Configuration Modification |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy |
production |
2026-09-18 |
| elastic |
Suspicious SIP Check by macOS Application |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
OpenSSL Password Hash Generation |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Microsoft Windows Defender Tampering |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Deletion |
production |
2026-09-18 |
| elastic |
Potential Windows Error Manager Masquerading |
production |
2026-09-18 |
| elastic |
Incoming Execution via WinRM Remote Shell |
production |
2026-09-18 |
| elastic |
Suspicious which Enumeration |
production |
2026-09-18 |
| elastic |
Network Connection via Signed Binary |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Unusual Kill Signal |
production |
2026-09-18 |
| elastic |
Windows Server Update Service Spawning Suspicious Processes |
production |
2026-09-18 |