| elastic |
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
Kubernetes API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Kubernetes Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostPID |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes Privileged Pod Created |
production |
2026-09-18 |
| elastic |
Kubernetes RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
Unusual Kubernetes Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Modified RBAC Objects |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Assignment of Controller Service Account |
production |
2026-09-18 |
| elastic |
High Mean of Process Arguments in an RDP Session |
production |
2026-09-18 |
| elastic |
High Mean of RDP Session Duration |
production |
2026-09-18 |
| elastic |
Unusual Remote File Size |
production |
2026-09-18 |
| elastic |
High Variance in RDP Session Duration |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
Unusual Remote File Extension |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made from a Source IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made to a Destination IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Processes in an RDP Session |
production |
2026-09-18 |
| elastic |
Spike in Remote File Transfers |
production |
2026-09-18 |
| elastic |
Unusual Time or Day for an RDP Session |
production |
2026-09-18 |
| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-09-18 |
| elastic |
M365 Azure Monitor Alert Email with Financial or Billing Theme |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Items Accessed Excessively |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
Multiple Device Token Hashes for Single Okta Session |
production |
2026-09-18 |
| elastic |
Okta Multiple OS Names Detected for a Single DT Hash |
production |
2026-09-18 |
| elastic |
Okta AiTM Session Cookie Replay |
production |
2026-09-18 |
| elastic |
Multiple Okta User Authentication Events with Same Device Token Hash |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Device Token Rotation) |
production |
2026-09-18 |
| elastic |
Potential Okta Brute Force (Multi-Source) |
production |
2026-09-18 |
| elastic |
Potential Okta Credential Stuffing (Single Source) |
production |
2026-09-18 |
| elastic |
Potential Okta MFA Bombing via Push Notifications |
production |
2026-09-18 |
| elastic |
Potential Okta Password Spray (Multi-Source) |
production |
2026-09-18 |