| elastic |
Azure Storage Account Keys Accessed by Privileged User |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Registered Application Owner |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance Made Public |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
GKE API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Entra ID Protection Alerts for User Detected |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Malicious File - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Malicious File - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Behavior - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Behavior - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-In via Unusual Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth ROPC Grant Login Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Reported Suspicious Activity |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Password Modified |
production |
2026-09-18 |
| elastic |
Endpoint Security (Elastic Defend) |
production |
2026-09-18 |
| elastic |
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) |
production |
2026-09-18 |
| elastic |
Azure AKS API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Spike in Azure Activity Logs Failed Messages |
production |
2026-09-18 |
| elastic |
AWS Organizations Delegated Administrator Registered |
production |
2026-09-18 |
| elastic |
AWS STS GetFederationToken with AdministratorAccess in Request |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
Memory Threat - Prevented- Elastic Defend |
production |
2026-09-18 |
| elastic |
Rare Azure Activity Logs Event Failures |
production |
2026-09-18 |
| elastic |
Memory Threat - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Unusual City for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request Predicted to be a DGA Domain |
production |
2026-09-18 |