| elastic |
AWS STS Role Chaining |
production |
2026-09-18 |
| elastic |
Azure Key Vault Excessive Secret or Key Retrieved |
production |
2026-09-18 |
| elastic |
Azure Key Vault Unusual Secret Key Usage |
production |
2026-09-18 |
| elastic |
Azure VNet Full Network Packet Capture Enabled |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
Azure Automation Runbook Deleted |
production |
2026-09-18 |
| elastic |
Azure AKS Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device |
production |
2026-09-18 |
| elastic |
Azure Event Hub Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Deleted |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Front Door WAF Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Network Watcher Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Alert Suppression Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Permissions Modified |
production |
2026-09-18 |
| elastic |
Azure AD Graph High 4xx Error Ratio from User |
production |
2026-09-18 |
| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual Client and User |
production |
2026-09-18 |
| elastic |
Azure AKS Potential API Enumeration by User |
production |
2026-09-18 |
| elastic |
Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity |
production |
2026-09-18 |
| elastic |
Azure Storage Anonymous Blob Access to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Microsoft Graph Multi-Category Reconnaissance Burst |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Container Access Level Modified |
production |
2026-09-18 |
| elastic |
Azure Automation Runbook Created or Modified |
production |
2026-09-18 |
| elastic |
Azure AKS Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Azure AKS Kubelet Proxy to Command Execution Endpoint |
production |
2026-09-18 |
| elastic |
Azure AKS Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Azure AKS Attempted User Exec into Pod |
production |
2026-09-18 |
| elastic |
Azure VM Extension CRUD Operation with Unusual Source ASN |
production |
2026-09-18 |
| elastic |
Azure VM Managed Run Command Created or Updated with Unusual Principal |
production |
2026-09-18 |
| elastic |
Azure Compute VM Command Executed |
production |
2026-09-18 |
| elastic |
Azure Storage Blob Retrieval via AzCopy |
production |
2026-09-18 |
| elastic |
Azure Compute Restore Point Collection Deleted by Unusual User |
production |
2026-09-18 |
| elastic |
Azure Compute Restore Point Collections Deleted |
production |
2026-09-18 |
| elastic |
Azure Compute Snapshot Deletion by Unusual User and Resource Group |
production |
2026-09-18 |