| elastic |
Microsoft Foundry Keys or Connection Secrets Accessed by New Principal |
production |
2026-10-23 |
| elastic |
First Time GCP Vertex AI Inference by Caller from Source ASN |
production |
2026-10-23 |
| elastic |
AWS Bedrock Model Invocation Impossible Travel |
production |
2026-10-23 |
| elastic |
AWS Bedrock Model Invocation From High Number of Countries |
production |
2026-10-23 |
| elastic |
AWS EKS Suspicious Assignment of Controller Service Account |
production |
2026-10-21 |
| elastic |
AWS EKS Unusual Decision by User Agent |
production |
2026-10-21 |
| elastic |
AWS EKS Anonymous Request Authorized by Unusual User Agent |
production |
2026-10-21 |
| elastic |
Entra ID Service Principal with Unusual Source ASN |
production |
2026-10-19 |
| elastic |
Entra ID Application Self-Assigned to Privileged Role |
production |
2026-10-19 |
| elastic |
M365 Identity Login from Atypical Region |
production |
2026-10-19 |
| elastic |
Entra ID Privileged Role Assigned to Another Account |
production |
2026-10-19 |
| elastic |
OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent |
production |
2026-10-09 |
| splunk |
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script |
production |
2026-10-09 |
| elastic |
GCP Vertex AI Caller Impossible Travel |
production |
2026-10-07 |
| elastic |
AWS Bedrock AgentCore with Public Network Browser or Code Interpreter Sandbox |
production |
2026-10-07 |
| elastic |
Potential Credential Access via DCSync |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Impossible Travel Login |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise User Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
GCP Vertex AI Caller Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
Okta User Sessions Started from Different Geolocations |
production |
2026-10-06 |
| elastic |
Potentially Successful Okta MFA Bombing via Push Notifications |
production |
2026-10-06 |
| elastic |
Potential Okta MFA Bombing via Push Notifications |
production |
2026-10-06 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-10-06 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-10-06 |
| elastic |
AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key |
production |
2026-10-06 |
| elastic |
AWS IAM CompromisedKeyQuarantine Policy Attached to User |
production |
2026-10-06 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
Microsoft Foundry Subscription Key Impossible Travel |
production |
2026-10-05 |
| elastic |
Anthropic User Activity From High Number of Countries |
production |
2026-10-05 |
| elastic |
ESXi Root Password Accepted from Remote Host |
production |
2026-09-30 |
| elastic |
FortiGate FortiCloud SSO Login from Unusual Source |
production |
2026-09-28 |
| elastic |
First-Time FortiGate Administrator Login |
production |
2026-09-28 |
| sigma |
Azure Subscription Permission Elevation Via AuditLogs |
test |
2026-09-26 |
| elastic |
AWS Bedrock API Key Phantom User Activity Outside Bedrock |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime |
production |
2026-09-25 |
| elastic |
Anthropic Impossible Travel Login |
production |
2026-09-25 |
| elastic |
Anthropic Session Reuse Impossible Travel |
production |
2026-09-25 |
| elastic |
GitHub OAuth Application Authorized |
production |
2026-09-24 |
| splunk |
Cloud Provisioning Activity From Previously Unseen Country |
production |
2026-09-22 |
| splunk |
Cloud Provisioning Activity From Previously Unseen IP Address |
production |
2026-09-22 |
| splunk |
Cloud API Calls From Previously Unseen User Roles |
production |
2026-09-22 |
| splunk |
Cloud Provisioning Activity From Previously Unseen City |
production |
2026-09-22 |
| elastic |
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP |
production |
2026-09-22 |
| splunk |
Cloud Provisioning Activity From Previously Unseen Region |
production |
2026-09-22 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID High Risk User Sign-in Heuristic |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-In via Unusual Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth ROPC Grant Login Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Reported Suspicious Activity |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Unusual City for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual Country for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Azure Automation Account Created |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Entra ID Privileged Identity Management (PIM) Role Modified |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Rolebindings Created |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Error |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Recommended Monitor |
production |
2026-09-18 |
| elastic |
GKE Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
GKE Suspicious Assignment of Controller Service Account |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
First Time Seen Google Workspace OAuth Login from Third-Party Application |
production |
2026-09-18 |
| elastic |
External User Added to Google Workspace Group |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Suspended User Account Renewed |
production |
2026-09-18 |
| elastic |
Google Workspace User Sign-in from Atypical Device Type |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
Kubernetes Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Assignment of Controller Service Account |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Identity Login from Impossible Travel Location |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device) |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth ROPC Grant via Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
M365 Identity Unusual SSO Authentication Errors for User |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Okta User Session Impersonation |
production |
2026-09-18 |
| elastic |
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials |
production |
2026-09-18 |
| elastic |
High Number of Okta User Password Reset or Unlock Attempts |
production |
2026-09-18 |
| elastic |
First Occurrence of Okta User Session Started via Proxy |
production |
2026-09-18 |
| elastic |
Okta Alerts Following Unusual Proxy Authentication |
production |
2026-09-18 |
| elastic |
Unauthorized Access to an Okta Application |
production |
2026-09-18 |
| elastic |
Okta Sign-In Events via Third-Party IdP |
production |
2026-09-18 |
| elastic |
Successful Application SSO from Rare Unknown Client Device |
production |
2026-09-18 |
| elastic |
Suspicious Activity Reported by Okta User |
production |
2026-09-18 |
| elastic |
Spike in Privileged Command Execution by a User |
production |
2026-09-18 |
| elastic |
High Command Line Entropy Detected for Privileged Commands |
production |
2026-09-18 |
| elastic |
Unusual Process Detected for Privileged Commands by a User |
production |
2026-09-18 |
| elastic |
Unusual Spike in Concurrent Active Sessions by a User |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Spike in Group Application Assignment Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Lifecycle Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Membership Events |
production |
2026-09-18 |
| elastic |
Spike in Group Privilege Change Events |
production |
2026-09-18 |
| elastic |
Spike in User Lifecycle Management Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Management Events |
production |
2026-09-18 |
| elastic |
Spike in Special Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Unusual Privilege Type assigned to a User |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual IP Address |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Potential Suspicious DebugFS Root Device Access |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
Attempt to Enable the Root Account |
production |
2026-09-18 |
| elastic |
Apple Scripting Execution with Administrator Privileges |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| elastic |
Potential Admin Group Account Addition |
production |
2026-09-18 |
| elastic |
User Added to the Admin Group |
production |
2026-09-18 |
| elastic |
Spike in Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Unusual Hour for a User to Logon |
production |
2026-09-18 |
| elastic |
Unusual Source IP for a User to Logon from |
production |
2026-09-18 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Unusual Linux Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Remote User |
production |
2026-09-18 |
| elastic |
Unusual Windows User Privilege Elevation Activity |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
First Seen SonicWall Remote Access Login by User and Source |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Login from Multiple IP Addresses |
production |
2026-09-18 |
| elastic |
First Time Seen Account Performing DCSync |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| elastic |
Account Discovery Command via SYSTEM Account |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
AdminSDHolder Backdoor |
production |
2026-09-18 |
| elastic |
AdminSDHolder SDProp Exclusion Added |
production |
2026-09-18 |
| elastic |
Potential Account Takeover - Mixed Logon Types |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
Potential Privileged Escalation via SamAccountName Spoofing |
production |
2026-09-18 |
| elastic |
Remote Computer Account DnsHostName Update |
production |
2026-09-18 |
| elastic |
Potential Account Takeover - Logon from New Source IP |
production |
2026-09-18 |
| elastic |
Potential Impersonation Attempt via Kubectl |
production |
2026-09-18 |
| elastic |
M365 or Entra ID Identity Sign-in from a Suspicious Source |
production |
2026-09-18 |
| elastic |
FortiGate SSL VPN Login Followed by SIEM Alert by User |
production |
2026-09-18 |
| elastic |
AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role |
production |
2026-09-18 |
| elastic |
AWS Cognito Unauthenticated Identity Pool Credentials Issued |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key First Seen from Source IP |
production |
2026-09-18 |
| elastic |
AWS CloudShell Environment Created |
production |
2026-09-18 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN |
production |
2026-09-18 |
| elastic |
AWS Rare Source AS Organization Activity |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Access Token Used from Multiple Addresses |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
Unusual City For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual Country For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
AWS IAM API Calls via Temporary Session Tokens |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Added for Root |
production |
2026-09-18 |
| elastic |
AWS IAM OIDC Provider Created by Rare User |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by User |
production |
2026-09-18 |
| elastic |
AWS SageMaker Execution Role Passed by Unusual Principal |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRoot by Rare User and Member Account |
production |
2026-09-18 |
| elastic |
AWS STS Role Chaining |
production |
2026-09-18 |
| elastic |
Entra ID Sharepoint or OneDrive Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Flow with Concurrent Sign-ins |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Azure Storage Account Keys Accessed by Privileged User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth User Impersonation to Microsoft Graph |
production |
2026-09-18 |
| elastic |
Entra ID High Risk Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Protection Alerts for User Detected |
production |
2026-09-18 |
| elastic |
Entra ID Protection Admin Confirmed Compromise |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
AWS IAM Assume Role Policy Update |
production |
2026-09-17 |
| splunk |
Cisco IOS XE WebUI Programmatic Configuration |
production |
2026-09-08 |
| elastic |
Kubernetes Unusual Decision by User Agent |
deprecated |
2026-08-21 |
| splunk |
Linux Usermod Root UID Set |
production |
2026-07-08 |
| splunk |
Windows Large Number of Computer Service Tickets Requested |
production |
2026-07-05 |
| splunk |
Cisco IOS XE WebUI Login From IOSd Local Port |
production |
2026-05-19 |
| splunk |
Splunk User Enumeration Attempt |
production |
2026-05-14 |
| splunk |
ESXi Shared or Stolen Root Account |
production |
2026-05-13 |
| splunk |
ESXi User Granted Admin Role |
production |
2026-05-13 |
| splunk |
M365 Copilot Application Usage Pattern Anomalies |
production |
2026-05-13 |
| splunk |
M365 Copilot Session Origin Anomalies |
production |
2026-05-13 |
| splunk |
Okta Risk Threshold Exceeded |
production |
2026-05-13 |
| splunk |
PingID Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
Zoom High Video Latency |
experimental |
2026-05-13 |
| splunk |
ASL AWS SAML Update identity provider |
production |
2026-05-13 |
| splunk |
AWS Bedrock Invoke Model Access Denied |
production |
2026-05-13 |
| splunk |
AWS SAML Update identity provider |
production |
2026-05-13 |
| splunk |
Azure AD Multiple AppIDs and UserAgents Authentication Spike |
production |
2026-05-13 |
| splunk |
GCP Detect gcploit framework |
experimental |
2026-05-13 |
| splunk |
Geographic Improbable Location |
experimental |
2026-05-13 |
| splunk |
O365 Multiple AppIDs and UserAgents Authentication Spike |
production |
2026-05-13 |
| splunk |
Okta Non-Standard VPN Usage |
experimental |
2026-05-13 |
| splunk |
Windows Multiple Accounts Deleted |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Priority Intrusion Classification |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| splunk |
Cisco IOS Suspicious Privileged Account Creation |
production |
2026-05-13 |
| splunk |
ESXi Account Modified |
production |
2026-05-13 |
| splunk |
ESXi External Root Login Activity |
production |
2026-05-13 |
| splunk |
Windows Multiple Account Passwords Changed |
production |
2026-05-13 |
| splunk |
Windows Multiple Accounts Disabled |
production |
2026-05-13 |
| splunk |
Unusual Number of Computer Service Tickets Requested |
experimental |
2026-05-13 |
| splunk |
Unusual Number of Remote Endpoint Authentication Events |
experimental |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| sigma |
User Added to an Administrator's Azure AD Role |
test |
2026-04-30 |
| sigma |
Google Workspace Government Attack Warning |
experimental |
2026-04-28 |
| elastic |
Deprecated - AWS Root Login Without MFA |
deprecated |
2025-11-21 |
| sigma |
Account Tampering - Suspicious Failed Logon Reasons |
test |
2025-10-17 |
| sigma |
Suspicious SignIns From A Non Registered Device |
test |
2025-07-02 |
| sigma |
Azure Login Bypassing Conditional Access Policies |
experimental |
2025-01-08 |
| sigma |
AWS Key Pair Import Activity |
experimental |
2024-12-19 |
| snort |
ET WEB_SPECIFIC_APPS Fortra FileCatalyst Workflow Insecure HSQLDB Default Credentials |
rev 1 |
2024-08-29 |
| suricata |
ET WEB_SPECIFIC_APPS Fortra FileCatalyst Workflow Insecure HSQLDB Default Credentials |
rev 1 |
2024-08-29 |
| sigma |
Kubernetes Admission Controller Modification |
test |
2024-07-11 |
| sigma |
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure |
test |
2024-07-11 |
| sigma |
External Remote SMB Logon from Public IP |
test |
2024-03-11 |
| sigma |
External Remote RDP Logon from Public IP |
test |
2024-03-11 |
| sigma |
Failed Logon From Public IP |
test |
2024-03-11 |
| sigma |
OpenCanary - Telnet Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - SSH New Connection Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - SSH Login Attempt |
test |
2024-03-08 |
| sigma |
Roles Activated Too Frequently |
test |
2023-09-14 |
| sigma |
Roles Are Not Being Used |
test |
2023-09-14 |
| sigma |
Too Many Global Admins |
test |
2023-09-14 |
| sigma |
Roles Activation Doesn't Require MFA |
test |
2023-09-14 |
| sigma |
Stale Accounts In A Privileged Role |
test |
2023-09-14 |
| sigma |
Invalid PIM License |
test |
2023-09-14 |
| sigma |
Roles Assigned Outside PIM |
test |
2023-09-14 |
| sigma |
Azure AD Threat Intelligence |
test |
2023-09-07 |
| sigma |
Impossible Travel |
test |
2023-09-03 |
| sigma |
Suspicious Browser Activity |
test |
2023-09-03 |
| sigma |
Unfamiliar Sign-In Properties |
test |
2023-09-03 |
| sigma |
Atypical Travel |
test |
2023-09-03 |
| sigma |
Activity From Anonymous IP Address |
test |
2023-09-03 |
| sigma |
New Country |
test |
2023-09-03 |
| sigma |
Root Account Enable Via Dsenableroot |
test |
2023-08-22 |
| sigma |
Password Provided In Command Line Of Net.EXE |
test |
2023-02-21 |
| sigma |
Guest Account Enabled Via Sysadminctl |
test |
2023-02-18 |
| sigma |
Huawei BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Cisco BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Juniper BGP Missing MD5 |
test |
2023-01-23 |
| sigma |
Cisco LDP Authentication Failures |
test |
2023-01-09 |
| sigma |
Win Susp Computer Name Containing Samtheadmin |
test |
2023-01-04 |
| sigma |
Google Cloud Kubernetes Admission Controller |
test |
2022-12-18 |
| sigma |
AWS Suspicious SAML Activity |
test |
2022-12-18 |
| sigma |
Azure Unusual Authentication Interruption |
test |
2022-12-18 |
| sigma |
Azure Kubernetes Admission Controller |
test |
2022-12-18 |
| sigma |
Logon from a Risky IP Address |
test |
2022-10-09 |
| sigma |
Account Created And Deleted Within A Close Time Frame |
test |
2022-08-18 |
| sigma |
PIM Alert Setting Changes To Disabled |
test |
2022-08-09 |
| sigma |
Suspicious Remote Logon with Explicit Credentials |
test |
2022-08-03 |
| elastic |
Auditd Login from Forbidden Location |
deprecated |
2022-07-25 |
| elastic |
Auditd Max Failed Login Attempts |
deprecated |
2022-07-25 |
| elastic |
Auditd Login Attempt at Forbidden Time |
deprecated |
2022-07-25 |
| elastic |
Auditd Max Login Sessions |
deprecated |
2022-07-25 |
| sigma |
Azure Domain Federation Settings Modified |
test |
2022-06-08 |
| sigma |
Applications That Are Using ROPC Authentication Flow |
test |
2022-06-01 |
| sigma |
Application Using Device Code Authentication Flow |
test |
2022-06-01 |
| sigma |
Suspicious Computer Machine Password by PowerShell |
test |
2022-02-21 |
| sigma |
Microsoft 365 - Impossible Travel Activity |
test |
2021-11-27 |
| sigma |
User Added to Local Administrator Group |
stable |
2021-01-17 |
| sentinel |
Failed AWS Console logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to AWS Console |
Scheduled |
— |
| sentinel |
Anomaly Sign In Event from an IP |
Scheduled |
— |
| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
User login from different countries within 3 hours (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
User joining Zoom meeting from suspicious timezone |
Scheduled |
— |
| sentinel |
New country signIn with correct password |
Scheduled |
— |
| sentinel |
New user created and added to the built-in administrators group |
Scheduled |
— |
| sentinel |
User account enabled and disabled within 10 mins |
Scheduled |
— |
| sentinel |
User account created and deleted within 10 mins |
Scheduled |
— |
| sentinel |
User account added to built in domain local or global group |
Scheduled |
— |
| sentinel |
Account added and removed from privileged groups |
Scheduled |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
AdminSDHolder Modifications |
Scheduled |
— |
| sentinel |
Workspace deletion activity from an infected device |
Scheduled |
— |
| sentinel |
Detect PIM Alert Disabling activity |
Scheduled |
— |
| sentinel |
NRT Malicious Inbox Rule |
NRT |
— |
| sentinel |
Suspicious VM Instance Creation Activity Detected |
Scheduled |
— |
| sentinel |
M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity |
Scheduled |
— |
| sentinel |
Cisco - firewall block but success logon to Microsoft Entra ID |
Scheduled |
— |
| sentinel |
Multiple Password Reset by user |
Scheduled |
— |
| sentinel |
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt |
Scheduled |
— |
| sentinel |
Failed host logons but success logon to AzureAD |
Scheduled |
— |
| sentinel |
Email access via active sync |
Scheduled |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |
| sentinel |
Anomalous login followed by Teams action |
Scheduled |
— |