| splunk |
Short Lived Windows Accounts |
production |
2026-10-09 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-10-06 |
| splunk |
Potential password in username |
production |
2026-09-22 |
| elastic |
Attempt to Enable the Root Account |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
Potential Admin Group Account Addition |
production |
2026-09-18 |
| elastic |
User Added to the Admin Group |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Unusual Windows Username |
production |
2026-09-18 |
| elastic |
Unusual Windows User Privilege Elevation Activity |
production |
2026-09-18 |
| elastic |
Account Discovery Command via SYSTEM Account |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Potential Suspicious DebugFS Root Device Access |
production |
2026-09-18 |
| splunk |
Windows Builtin Account Name Was Changed |
production |
2026-08-24 |
| splunk |
Cisco ASA - User Privilege Level Change |
production |
2026-05-13 |
| splunk |
Detect Excessive User Account Lockouts |
production |
2026-05-13 |
| splunk |
Cisco ASA - New Local User Account Created |
production |
2026-05-13 |
| sigma |
Root Account Enable Via Dsenableroot |
test |
2023-08-22 |
| sigma |
User Added To Admin Group Via DseditGroup |
test |
2023-08-22 |
| sigma |
User Added To Admin Group Via Dscl |
test |
2023-03-19 |
| sigma |
User Added To Admin Group Via Sysadminctl |
test |
2023-03-19 |
| sigma |
Admin User Remote Logon |
test |
2022-10-09 |