| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-10-09 |
| elastic |
Anthropic Organization Member and Group Enumeration |
production |
2026-09-25 |
| elastic |
AWS EC2 Role GetCallerIdentity from New Source AS Organization |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
Azure AD Graph High 4xx Error Ratio from User |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual Client and User |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
AWS IAM Principal Enumeration via UpdateAssumeRolePolicy |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls via CLI from a Single Resource |
production |
2026-09-18 |
| elastic |
AWS STS GetCallerIdentity API Called for the First Time |
production |
2026-09-18 |
| elastic |
AWS Account Discovery By Rare User |
production |
2026-09-18 |
| splunk |
Azure AD Service Principal Enumeration |
production |
2026-05-13 |
| splunk |
Okta Unauthorized Access to Application |
production |
2026-05-13 |
| splunk |
Azure AD AzureHound UserAgent Detected |
production |
2026-05-13 |
| splunk |
Okta IDP Lifecycle Modifications |
production |
2026-05-13 |
| sigma |
AWS STS GetCallerIdentity Enumeration Via TruffleHog |
experimental |
2025-10-12 |
| sigma |
RBAC Permission Enumeration Attempt |
test |
2024-03-26 |
| sigma |
Discovery Using AzureHound |
test |
2022-11-27 |