| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth User Impersonation to Microsoft Graph |
production |
2026-09-18 |
| elastic |
Entra ID High Risk Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Illicit Consent Grant via Registered Application |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Created |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Credentials Created by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID Federated Identity Credential Issuer Modified |
production |
2026-09-18 |
| elastic |
Entra ID ADRS Token Request by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Unusual Cloud Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Registered Application Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello for Business Credential Registered |
production |
2026-09-18 |
| elastic |
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
Entra ID External Authentication Methods (EAM) Modified |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID Elevated Access to User Access Administrator |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Rolebindings Created |
production |
2026-09-18 |
| elastic |
Entra ID Custom Domain Added or Verified |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity with High Confidence |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Download Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Tunneling and/or Port Forwarding Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Container Workload Protection |
production |
2026-09-18 |
| elastic |
Cloud Credential Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive File Compression Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Read Detected via Defend for Containers |
production |
2026-09-18 |