| elastic |
Azure Automation Runbook Created or Modified |
production |
2026-09-18 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-09-18 |
| elastic |
SIP Provider Modification |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Container Access Level Modified |
production |
2026-09-18 |
| elastic |
Potential Secure File Deletion via SDelete Utility |
production |
2026-09-18 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-09-18 |
| elastic |
Microsoft Graph Multi-Category Reconnaissance Burst |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Potential Windows Session Hijacking via CcmExec |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Unusual Child Processes of RunDLL32 |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Suspicious Process Access via Direct System Call |
production |
2026-09-18 |
| elastic |
Windows Sandbox with Sensitive Configuration |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Azure Storage Anonymous Blob Access to Unusual Resource |
production |
2026-09-18 |
| elastic |
Suspicious WMIC XSL Script Execution |
production |
2026-09-18 |
| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
Unsigned DLL Side-Loading from a Suspicious Folder |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-09-18 |
| elastic |
Windows Firewall Disabled via PowerShell |
production |
2026-09-18 |
| elastic |
Unusual Network Connection via DllHost |
production |
2026-09-18 |
| elastic |
Potential Process Injection via PowerShell |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Special Character Overuse |
production |
2026-09-18 |
| elastic |
Potential Evasion via Filter Manager |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Reordering |
production |
2026-09-18 |
| elastic |
Potential Evasion via Windows Filtering Platform |
production |
2026-09-18 |
| elastic |
Signed Proxy Execution via MS Work Folders |
production |
2026-09-18 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Concatenation |
production |
2026-09-18 |
| elastic |
Host File System Changes via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Attempt to Install or Run Kali Linux via WSL |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Reverse Keywords |
production |
2026-09-18 |
| elastic |
Potential Enumeration via Active Directory Web Service |
production |
2026-09-18 |