| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Azure Run Command Correlated with Process Execution |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Entra ID High Risk Sign-in |
production |
2026-09-18 |
| elastic |
Okta FastPass Phishing Detection |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Application |
production |
2026-09-18 |
| elastic |
Potential Shadow File Read via Command Line Utilities |
production |
2026-09-18 |
| elastic |
Potential Network Scan Detected |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Windows Population |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
Okta Sign-In Events via Third-Party IdP |
production |
2026-09-18 |
| elastic |
Azure Key Vault Modified |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Default Cobalt Strike Team Server Certificate |
production |
2026-09-18 |
| elastic |
Anomalous Linux Compiler Activity |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Stolen Credentials Used to Login to Okta Account After MFA Reset |
production |
2026-09-18 |
| elastic |
Memory Threat - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Kubernetes Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Container Access Level Modified |
production |
2026-09-18 |
| elastic |
GKE Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Potential DNS Rebinding from Public to Private Address |
production |
2026-09-18 |
| elastic |
Behavior - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Kubernetes Cluster-Admin Role Binding Created |
production |
2026-09-18 |
| elastic |
Potential SIP Extension Enumeration |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution by Zoom |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
Entra ID Phishing Kit Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Web Server Potential Remote File Inclusion Activity |
production |
2026-09-18 |
| elastic |
Google Workspace Password Policy Modified |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Potential Local NTLM Relay via HTTP |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
PowerShell MiniDump Script |
production |
2026-09-18 |
| elastic |
Google Workspace Custom Admin Role Created |
production |
2026-09-18 |