| elastic |
Spike in Remote File Transfers |
production |
2026-09-18 |
| elastic |
Spike in Number of Processes in an RDP Session |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made to a Destination IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made from a Source IP |
production |
2026-09-18 |
| elastic |
Unusual Remote File Extension |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
High Variance in RDP Session Duration |
production |
2026-09-18 |
| elastic |
Unusual Remote File Size |
production |
2026-09-18 |
| elastic |
High Mean of RDP Session Duration |
production |
2026-09-18 |
| elastic |
High Mean of Process Arguments in an RDP Session |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Assignment of Controller Service Account |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Modified RBAC Objects |
production |
2026-09-18 |
| elastic |
Unusual Kubernetes Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
Kubernetes RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
Kubernetes Privileged Pod Created |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostPID |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Application Added to Google Workspace Domain |
production |
2026-09-18 |
| elastic |
Google Workspace Suspended User Account Renewed |
production |
2026-09-18 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
External User Added to Google Workspace Group |
production |
2026-09-18 |
| elastic |
Google Workspace MFA Enforcement Disabled For Organization |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Deletion |
production |
2026-09-18 |
| elastic |
Forwarded Google Workspace Security Alert |
production |
2026-09-18 |
| elastic |
Google Workspace Restrictions for Marketplace Modified to Allow Any App |
production |
2026-09-18 |
| elastic |
First Time Seen Google Workspace OAuth Login from Third-Party Application |
production |
2026-09-18 |
| elastic |
Google Workspace Bitlocker Setting Disabled |
production |
2026-09-18 |
| elastic |
Domain Added to Google Workspace Trusted Domains |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User |
production |
2026-09-18 |
| elastic |
Google Workspace Gmail Routing or Forwarding Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Data Transfer or Takeout Export Initiated |
production |
2026-09-18 |
| elastic |
GitHub Owner Role Granted To User |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |