| elastic |
Rare Connection to WebDAV Target |
production |
2026-09-18 |
| elastic |
Suspicious Activity Reported by Okta User |
production |
2026-09-18 |
| elastic |
Multiple Okta Sessions Detected for a Single User |
production |
2026-09-18 |
| elastic |
Potential Credential Access via LSASS Memory Dump |
production |
2026-09-18 |
| elastic |
Symbolic Link to Shadow Copy Created |
production |
2026-09-18 |
| elastic |
NTDS Dump via Wbadmin |
production |
2026-09-18 |
| elastic |
Adding Hidden File Attribute via Attrib |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Sensitive Audit Policy Sub-Category Disabled |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a System Process |
production |
2026-09-18 |
| elastic |
Code Signing Policy Modification Through Registry |
production |
2026-09-18 |
| elastic |
Windows Defender Disabled via Registry Modification |
production |
2026-09-18 |
| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
Modification or Removal of an Okta Application Sign-On Policy |
production |
2026-09-18 |
| elastic |
Spike in Group Management Events |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
ImageLoad via Windows Update Auto Update Client |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
Potential WSUS Abuse for Lateral Movement |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation via RPC |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
Browser Extension Install |
production |
2026-09-18 |
| elastic |
Registry Persistence via AppInit DLL |
production |
2026-09-18 |
| elastic |
Creation of a Hidden Local User Account |
production |
2026-09-18 |
| elastic |
Local Scheduled Task Creation |
production |
2026-09-18 |
| elastic |
Office Test Registry Persistence |
production |
2026-09-18 |
| elastic |
Persistence via a Windows Installer |
production |
2026-09-18 |
| elastic |
Persistence via PowerShell profile |
production |
2026-09-18 |
| elastic |
Account Password Reset Remotely |
production |
2026-09-18 |
| elastic |
Unusual Scheduled Task Update |
production |
2026-09-18 |
| elastic |
Suspicious Service was Installed in the System |
production |
2026-09-18 |
| elastic |
Startup Persistence by a Suspicious Process |
production |
2026-09-18 |
| elastic |
Suspicious Image Load (taskschd.dll) from MS Office |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Okta FastPass Phishing Detection |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Application |
production |
2026-09-18 |
| elastic |
Okta Alerts Following Unusual Proxy Authentication |
production |
2026-09-18 |
| elastic |
Execution via MSSQL xp_cmdshell Stored Procedure |
production |
2026-09-18 |
| elastic |
Werfault ReflectDebugger Persistence |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |