| elastic |
Unusual Kubernetes Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
Attempt to Enable the Root Account |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Creation |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
Emond Rules Creation or Modification |
production |
2026-09-18 |
| elastic |
Persistence via Docker Shortcut Modification |
production |
2026-09-18 |
| elastic |
Spike in Bytes Sent to an External Device |
production |
2026-09-18 |
| elastic |
Kubernetes RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
Kubernetes Privileged Pod Created |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostPID |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Server Access Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS IAM User Created Access Keys For Another User |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Expiration Lifecycle Configuration Added |
production |
2026-09-18 |
| elastic |
Mount Launched Inside a Container |
production |
2026-09-18 |
| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
AWS EC2 Security Group Configuration Change |
production |
2026-09-18 |
| elastic |
Adding Hidden File Attribute via Attrib |
production |
2026-09-18 |
| elastic |
NTDS Dump via Wbadmin |
production |
2026-09-18 |
| elastic |
Suspicious WMI Image Load from MS Office |
production |
2026-09-18 |
| elastic |
AWS Lambda Function URL Created with Public Access |
production |
2026-09-18 |
| elastic |
Suspicious Windows Command Shell Arguments |
production |
2026-09-18 |
| elastic |
GCP Logging Bucket Deletion |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Modification |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Deletion |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Creation |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| elastic |
GKE Secrets List from Unusual Source AS Organization |
production |
2026-09-18 |
| elastic |
GKE Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access Policy (CAP) Modified |
production |
2026-09-18 |
| elastic |
GKE Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
GKE Secret Access from Node or Denied Service Account |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Enlightenment |
production |
2026-09-18 |
| elastic |
GKE Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |