| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
Potential Credential Access via DCSync |
production |
2026-10-06 |
| splunk |
Windows AD User Suspicious UPN Change |
production |
2026-09-23 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Unusual Windows Username |
production |
2026-09-18 |
| elastic |
Unusual Windows User Privilege Elevation Activity |
production |
2026-09-18 |
| elastic |
First Time Seen Account Performing DCSync |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| elastic |
AdminSDHolder Backdoor |
production |
2026-09-18 |
| elastic |
AdminSDHolder SDProp Exclusion Added |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
Potential Privileged Escalation via SamAccountName Spoofing |
production |
2026-09-18 |
| elastic |
Remote Computer Account DnsHostName Update |
production |
2026-09-18 |
| elastic |
Spike in Special Logon Events |
production |
2026-09-18 |
| splunk |
Windows PowerView AD Access Control List Enumeration |
production |
2026-05-13 |
| splunk |
Detect Excessive Account Lockouts From Endpoint |
production |
2026-05-13 |
| splunk |
Suspicious Computer Account Name Change |
production |
2026-05-13 |
| splunk |
Suspicious Kerberos Service Ticket Request |
production |
2026-05-13 |
| splunk |
Suspicious Ticket Granting Ticket Request |
production |
2026-05-13 |
| splunk |
Windows Group Policy Object Created |
production |
2026-05-13 |
| sigma |
New DMSA Service Account Created in Specific OUs |
experimental |
2025-05-24 |
| sigma |
DMSA Link Attributes Modified |
experimental |
2025-05-24 |
| sigma |
DMSA Service Account Created in Specific OUs - PowerShell |
experimental |
2025-05-24 |
| sigma |
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure |
test |
2024-07-11 |
| sigma |
Admin User Remote Logon |
test |
2022-10-09 |