| elastic |
AWS EKS Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-10-21 |
| elastic |
Whoami Process Activity |
production |
2026-10-09 |
| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-10-09 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-10-08 |
| elastic |
AdFind Command Activity |
production |
2026-10-06 |
| elastic |
Anthropic Organization Member and Group Enumeration |
production |
2026-09-25 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| elastic |
Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Sudo Command Enumeration Detected |
production |
2026-09-18 |
| elastic |
Unusual User Privilege Enumeration via id |
production |
2026-09-18 |
| elastic |
Enumeration of Users or Groups via Built-in Commands |
production |
2026-09-18 |
| elastic |
Potential Enumeration via Active Directory Web Service |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
Enumeration of Administrator Accounts |
production |
2026-09-18 |
| elastic |
Suspicious Access to LDAP Attributes |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Enumeration of Privileged Local Groups Membership |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Kubectl Permission Discovery |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| splunk |
Windows PowerView AD Access Control List Enumeration |
production |
2026-05-13 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| sigma |
Malicious PowerShell Commandlets - PoshModule |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - ProcessCreation |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - ScriptBlock |
test |
2025-12-10 |