| elastic |
Microsoft Foundry Keys or Connection Secrets Accessed by New Principal |
production |
2026-10-23 |
| elastic |
AWS Bedrock Model Invocation Impossible Travel |
production |
2026-10-23 |
| elastic |
AWS Bedrock Model Invocation From High Number of Countries |
production |
2026-10-23 |
| elastic |
First Time GCP Vertex AI Inference by Caller from Source ASN |
production |
2026-10-23 |
| elastic |
Entra ID Service Principal with Unusual Source ASN |
production |
2026-10-19 |
| elastic |
M365 Identity Login from Atypical Region |
production |
2026-10-19 |
| elastic |
Entra ID Application Self-Assigned to Privileged Role |
production |
2026-10-19 |
| elastic |
Entra ID Privileged Role Assigned to Another Account |
production |
2026-10-19 |
| sigma |
Sign-in Failure Due to Conditional Access Requirements Not Met |
test |
2026-10-17 |
| elastic |
OpenAI ChatGPT Enterprise Authentication from a Suspicious User Agent |
production |
2026-10-09 |
| splunk |
Windows Entra User Management Via Azure CLI |
production |
2026-10-09 |
| elastic |
GCP Vertex AI Caller Impossible Travel |
production |
2026-10-07 |
| elastic |
AWS Bedrock AgentCore with Public Network Browser or Code Interpreter Sandbox |
production |
2026-10-07 |
| elastic |
AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Impossible Travel Login |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise User Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
GCP Vertex AI Caller Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
Okta User Sessions Started from Different Geolocations |
production |
2026-10-06 |
| elastic |
Potentially Successful Okta MFA Bombing via Push Notifications |
production |
2026-10-06 |
| elastic |
Potential Okta MFA Bombing via Push Notifications |
production |
2026-10-06 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-10-06 |
| elastic |
AWS IAM CompromisedKeyQuarantine Policy Attached to User |
production |
2026-10-06 |
| elastic |
Microsoft Foundry Subscription Key Impossible Travel |
production |
2026-10-05 |
| elastic |
Anthropic User Activity From High Number of Countries |
production |
2026-10-05 |
| elastic |
FortiGate FortiCloud SSO Login from Unusual Source |
production |
2026-09-28 |
| elastic |
Anthropic Session Reuse Impossible Travel |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Phantom User Activity Outside Bedrock |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime |
production |
2026-09-25 |
| elastic |
Anthropic Impossible Travel Login |
production |
2026-09-25 |
| elastic |
GitHub OAuth Application Authorized |
production |
2026-09-24 |
| elastic |
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP |
production |
2026-09-22 |
| splunk |
Cloud Compute Instance Created By Previously Unseen User |
production |
2026-09-22 |
| splunk |
Cloud Instance Modified By Previously Unseen User |
production |
2026-09-22 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth User Impersonation to Microsoft Graph |
production |
2026-09-18 |
| elastic |
Entra ID High Risk Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Protection Alerts for User Detected |
production |
2026-09-18 |
| elastic |
Entra ID Protection Admin Confirmed Compromise |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID High Risk User Sign-in Heuristic |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-In via Unusual Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth ROPC Grant Login Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Reported Suspicious Activity |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Unusual City for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual Country for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Rolebindings Created |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
First Time Seen Google Workspace OAuth Login from Third-Party Application |
production |
2026-09-18 |
| elastic |
External User Added to Google Workspace Group |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
Google Workspace Suspended User Account Renewed |
production |
2026-09-18 |
| elastic |
Google Workspace User Sign-in from Atypical Device Type |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Identity Login from Impossible Travel Location |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device) |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth ROPC Grant via Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
M365 Identity Unusual SSO Authentication Errors for User |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Okta User Session Impersonation |
production |
2026-09-18 |
| elastic |
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials |
production |
2026-09-18 |
| elastic |
High Number of Okta User Password Reset or Unlock Attempts |
production |
2026-09-18 |
| elastic |
First Occurrence of Okta User Session Started via Proxy |
production |
2026-09-18 |
| elastic |
Okta Alerts Following Unusual Proxy Authentication |
production |
2026-09-18 |
| elastic |
Unauthorized Access to an Okta Application |
production |
2026-09-18 |
| elastic |
Okta Sign-In Events via Third-Party IdP |
production |
2026-09-18 |
| elastic |
Successful Application SSO from Rare Unknown Client Device |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role |
production |
2026-09-18 |
| elastic |
AWS Cognito Unauthenticated Identity Pool Credentials Issued |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key First Seen from Source IP |
production |
2026-09-18 |
| elastic |
AWS CloudShell Environment Created |
production |
2026-09-18 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN |
production |
2026-09-18 |
| elastic |
AWS Rare Source AS Organization Activity |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
AWS Management Console Root Login |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Access Token Used from Multiple Addresses |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login Without MFA |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
Unusual City For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual Country For an AWS Command |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
AWS IAM API Calls via Temporary Session Tokens |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Added for Root |
production |
2026-09-18 |
| elastic |
AWS IAM OIDC Provider Created by Rare User |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by User |
production |
2026-09-18 |
| elastic |
AWS SageMaker Execution Role Passed by Unusual Principal |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRoot by Rare User and Member Account |
production |
2026-09-18 |
| elastic |
AWS STS Role Chaining |
production |
2026-09-18 |
| elastic |
Entra ID Sharepoint or OneDrive Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Flow with Concurrent Sign-ins |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Azure Storage Account Keys Accessed by Privileged User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
AWS IAM Assume Role Policy Update |
production |
2026-09-17 |
| sigma |
Suspicious Login Activity Classified By Google |
experimental |
2026-09-14 |
| splunk |
Okta Successful Single Factor Authentication |
production |
2026-05-13 |
| splunk |
ASL AWS Create Policy Version to allow all resources |
production |
2026-05-13 |
| splunk |
AWS Create Policy Version to allow all resources |
production |
2026-05-13 |
| splunk |
AWS SetDefaultPolicyVersion |
production |
2026-05-13 |
| splunk |
AWS Successful Single-Factor Authentication |
production |
2026-05-13 |
| splunk |
Azure AD Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
Azure AD Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal Authentication |
production |
2026-05-13 |
| splunk |
Azure AD Successful PowerShell Authentication |
production |
2026-05-13 |
| splunk |
Azure AD Successful Single-Factor Authentication |
production |
2026-05-13 |
| splunk |
Azure Runbook Webhook Created |
production |
2026-05-13 |
| splunk |
GCP Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
GCP Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
GCP Successful Single-Factor Authentication |
production |
2026-05-13 |
| splunk |
O365 Security And Compliance Alert Triggered |
production |
2026-05-13 |
| splunk |
Okta Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
Okta ThreatInsight Threat Detected |
production |
2026-05-13 |
| sigma |
Okta New Admin Console Behaviours |
test |
2026-04-27 |
| sigma |
AWS Successful Console Login Without MFA |
experimental |
2025-10-21 |
| sigma |
AWS SAML Provider Deletion Activity |
experimental |
2024-12-19 |
| sigma |
Github SSH Certificate Configuration Changed |
test |
2024-07-29 |
| sigma |
Bitbucket User Login Failure |
test |
2024-02-25 |
| sigma |
AWS IAM S3Browser LoginProfile Creation |
test |
2023-05-17 |
| sigma |
AWS IAM S3Browser Templated S3 Bucket Policy Creation |
test |
2023-05-17 |
| sigma |
AWS IAM S3Browser User or AccessKey Creation |
test |
2023-05-17 |
| sigma |
Potential MFA Bypass Using Legacy Client Authentication |
test |
2023-03-20 |
| sigma |
Github Self Hosted Runner Changes Detected |
test |
2023-01-27 |
| sigma |
Github New Secret Created |
test |
2023-01-20 |
| sigma |
Login to Disabled Account |
test |
2022-12-25 |
| sigma |
User Access Blocked by Azure Conditional Access |
test |
2022-12-25 |
| sigma |
Multifactor Authentication Interrupted |
test |
2022-12-18 |
| sigma |
AWS Root Credentials |
test |
2022-10-09 |
| sigma |
Sign-ins by Unknown Devices |
test |
2022-10-05 |
| sigma |
Azure Subscription Permission Elevation Via ActivityLogs |
test |
2022-08-23 |
| sigma |
Privileged Account Creation |
test |
2022-08-16 |
| sigma |
Guest User Invited By Non Approved Inviters |
test |
2022-08-10 |
| sigma |
Temporary Access Pass Added To An Account |
test |
2022-08-10 |
| sigma |
PIM Approvals And Deny Elevation |
test |
2022-08-09 |
| sigma |
Changes To PIM Settings |
test |
2022-08-09 |
| sigma |
User Added To Privilege Role |
test |
2022-08-06 |
| sigma |
Password Reset By User Account |
test |
2022-08-03 |
| sigma |
Azure AD Only Single Factor Authentication Required |
test |
2022-07-27 |
| sigma |
User State Changed From Guest To Member |
test |
2022-06-30 |
| sigma |
Bitlocker Key Retrieval |
test |
2022-06-28 |
| sigma |
Device Registration or Join Without MFA |
test |
2022-06-28 |
| sigma |
Users Added to Global or Device Admin Roles |
test |
2022-06-28 |
| sigma |
Sign-ins from Non-Compliant Devices |
test |
2022-06-28 |
| sigma |
Use of Legacy Authentication Protocols |
test |
2022-06-17 |
| sigma |
Account Disabled or Blocked for Sign in Attempts |
test |
2022-06-17 |
| sigma |
Application URI Configuration Changes |
test |
2022-06-02 |
| sigma |
Application AppID Uri Configuration Changes |
test |
2022-06-02 |
| sigma |
Multifactor Authentication Denied |
test |
2022-03-24 |
| sentinel |
Changes to PIM Settings |
Scheduled |
— |
| sentinel |
Conditional Access Policy Modified by New User |
Scheduled |
— |
| sentinel |
Service Principal Authentication Attempt from New Country |
Scheduled |
— |
| sentinel |
Privileged User Logon from new ASN |
Scheduled |
— |
| sentinel |
Authentications of Privileged Accounts Outside of Expected Controls |
Scheduled |
— |
| sentinel |
Authentication Attempt from New Country |
Scheduled |
— |
| sentinel |
Anomalous Single Factor Signin |
Scheduled |
— |
| sentinel |
Suspicious modification of Global Administrator user properties |
Scheduled |
— |
| sentinel |
End-user consent stopped due to risk-based consent |
Scheduled |
— |
| sentinel |
Addition of a Temporary Access Pass to a Privileged Account |
Scheduled |
— |
| sentinel |
Changes to Application Ownership |
Scheduled |
— |
| sentinel |
Changes to Application Logout URL |
Scheduled |
— |
| sentinel |
Suspicious Sign In by Entra ID Connect Sync Account |
Scheduled |
— |
| sentinel |
URL Added to Application from Unknown Domain |
Scheduled |
— |
| sentinel |
Suspicious linking of existing user to external User |
Scheduled |
— |
| sentinel |
Service Principal Assigned Privileged Role |
Scheduled |
— |
| sentinel |
Service Principal Assigned App Role With Sensitive Access |
Scheduled |
— |
| sentinel |
Guest Users Invited to Tenant by New Inviters |
Scheduled |
— |
| sentinel |
Application Redirect URL Update |
Scheduled |
— |
| sentinel |
Application ID URI Changed |
Scheduled |
— |
| sentinel |
Suspicious Login from deleted guest account |
Scheduled |
— |