| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Quick Assist Full Control Sharing Mode Enabled |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| elastic |
AWS SageMaker Execution Role Passed by Unusual Principal |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Suspended |
production |
2026-09-18 |
| elastic |
Port Forwarding Rule Addition |
production |
2026-09-18 |
| elastic |
Newly Observed ScreenConnect Host Server |
production |
2026-09-18 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
Multiple Remote Management Tool Vendors on Same Host |
production |
2026-09-18 |
| elastic |
Potential File Download via a Headless Browser |
production |
2026-09-18 |
| elastic |
Connection to Commonly Abused Free SSL Certificate Providers |
production |
2026-09-18 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Outlook Home Page Registry Modification |
production |
2026-09-18 |
| elastic |
Entra ID Unusual Cloud Device Registration |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Port Activity |
production |
2026-09-18 |
| elastic |
AWS KMS Customer Managed Key Disabled or Scheduled for Deletion |
production |
2026-09-18 |
| elastic |
Decline in host-based traffic |
production |
2026-09-18 |
| elastic |
Sudoers File Activity |
production |
2026-09-18 |
| elastic |
Browser Process Spawned from an Unusual Parent |
production |
2026-09-18 |
| elastic |
M365 OneDrive/SharePoint Excessive File Downloads |
production |
2026-09-18 |
| elastic |
AWS S3 Object Versioning Suspended |
production |
2026-09-18 |
| elastic |
Linux Clipboard Activity Detected |
production |
2026-09-18 |
| elastic |
AWS KMS Key Policy Updated via PutKeyPolicy |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Unusual Source IP for a User to Logon from |
production |
2026-09-18 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Unusual Linux Username |
production |
2026-09-18 |
| elastic |
Rare Powershell Script |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Discovery Activity |
production |
2026-09-18 |
| elastic |
Unusual Hour for a User to Logon |
production |
2026-09-18 |
| elastic |
Outbound Scheduled Task Activity via PowerShell |
production |
2026-09-18 |
| elastic |
Unusual Linux System Information Discovery Activity |
production |
2026-09-18 |