| elastic |
AWS EKS Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-10-21 |
| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-10-09 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-10-08 |
| elastic |
Anthropic Organization Member and Group Enumeration |
production |
2026-09-25 |
| elastic |
Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
AWS IAM Successful Group Deletion |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Successful Group Deletion |
production |
2026-05-13 |
| sigma |
RBAC Permission Enumeration Attempt |
test |
2024-03-26 |