| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-10-09 |
| elastic |
AdFind Command Activity |
production |
2026-10-06 |
| elastic |
ESXi System and Account Enumeration |
production |
2026-09-30 |
| elastic |
Anthropic Organization Member and Group Enumeration |
production |
2026-09-25 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
Azure AD Graph High 4xx Error Ratio from User |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual Client and User |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Microsoft Graph Multi-Category Reconnaissance Burst |
production |
2026-09-18 |
| elastic |
Unusual User Privilege Enumeration via id |
production |
2026-09-18 |
| elastic |
Potential Meterpreter Reverse Shell |
production |
2026-09-18 |
| elastic |
Enumeration of Users or Groups via Built-in Commands |
production |
2026-09-18 |
| elastic |
Potential Enumeration via Active Directory Web Service |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
Enumeration of Administrator Accounts |
production |
2026-09-18 |
| elastic |
Account Discovery Command via SYSTEM Account |
production |
2026-09-18 |
| elastic |
Suspicious Access to LDAP Attributes |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls via CLI from a Single Resource |
production |
2026-09-18 |
| elastic |
AWS STS GetCallerIdentity API Called for the First Time |
production |
2026-09-18 |
| elastic |
AWS EC2 Role GetCallerIdentity from New Source AS Organization |
production |
2026-09-18 |
| elastic |
AWS Account Discovery By Rare User |
production |
2026-09-18 |
| sigma |
Webshell Detection With Command Line Keywords |
test |
2026-07-14 |
| sigma |
Suspicious Use of PsLogList |
test |
2026-06-29 |
| splunk |
Windows Account Discovery With NetUser PreauthNotRequire |
production |
2026-05-13 |
| splunk |
Windows Account Discovery for Sam Account Name |
production |
2026-05-13 |
| splunk |
Enumerate Users Local Group Using Telegram |
production |
2026-05-13 |
| splunk |
Windows Special Privileged Logon On Multiple Hosts |
production |
2026-05-13 |
| sigma |
Malicious PowerShell Commandlets - PoshModule |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - ScriptBlock |
test |
2025-12-10 |
| sigma |
Malicious PowerShell Commandlets - ProcessCreation |
test |
2025-12-10 |
| sigma |
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities |
test |
2025-12-02 |
| sigma |
HackTool - SOAPHound Execution |
test |
2024-01-26 |
| sigma |
Potential Pikabot Discovery Activity |
test |
2024-01-26 |
| sigma |
Uncommon Connection to Active Directory Web Services |
test |
2024-01-26 |
| sigma |
Webshell Hacking Activity Patterns |
test |
2023-11-09 |
| sigma |
HackTool - winPEAS Execution |
test |
2023-03-23 |
| sigma |
PUA - Seatbelt Execution |
test |
2023-02-04 |
| sigma |
Hacktool Ruler |
test |
2022-10-09 |
| sigma |
Chopper Webshell Process Pattern |
test |
2022-10-01 |
| sigma |
Network Reconnaissance Activity |
test |
2022-02-07 |
| sigma |
SharpHound Recon Account Discovery |
test |
2022-01-01 |