| elastic |
GCP Vertex AI Role Granted to Principal |
production |
2026-10-23 |
| elastic |
AWS EKS Creation or Modification of Sensitive Role |
production |
2026-10-21 |
| elastic |
AWS EKS Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-10-21 |
| elastic |
AWS EKS Service Account Modified RBAC Objects |
production |
2026-10-21 |
| elastic |
AWS EKS Cluster-Admin Role Binding Created |
production |
2026-10-21 |
| elastic |
AWS EKS Unusual Kubernetes Sensitive Workload Modification |
production |
2026-10-21 |
| elastic |
AWS EKS Sensitive RBAC Change Followed by Workload Modification |
production |
2026-10-21 |
| elastic |
M365 Exchange MFA Notification Email Deleted or Moved |
production |
2026-10-20 |
| elastic |
AWS EKS RBAC Wildcard Elevation on Existing Role |
production |
2026-10-20 |
| elastic |
Entra ID Application Credential Modified |
production |
2026-10-19 |
| elastic |
Entra ID Application Self-Assigned to Privileged Role |
production |
2026-10-19 |
| sigma |
HackTool - GoldenDMSA Execution |
experimental |
2026-10-19 |
| elastic |
Entra ID Service Principal Credentials Created by Unusual User |
production |
2026-10-19 |
| elastic |
Entra ID Global Administrator Role Assigned |
production |
2026-10-19 |
| elastic |
Entra ID Privileged Role Assigned to Another Account |
production |
2026-10-19 |
| elastic |
AWS EKS Client Certificate Signing Request Created or Approved |
production |
2026-10-09 |
| elastic |
OpenSSL Password Hash Generation |
production |
2026-10-09 |
| splunk |
Windows Entra User Management Via Azure CLI |
production |
2026-10-09 |
| elastic |
Linux User Added to Privileged Group |
production |
2026-10-09 |
| elastic |
AWS EKS Authentication Configuration Modified |
production |
2026-10-09 |
| elastic |
Entra ID Device Registration with Phishing Kit Default OS Build |
production |
2026-10-07 |
| elastic |
Anthropic Primary Owner Transferred |
production |
2026-10-07 |
| elastic |
AWS Bedrock AgentCore with Public Network Browser or Code Interpreter Sandbox |
production |
2026-10-07 |
| elastic |
Anthropic Admin Role Assigned to User |
production |
2026-10-07 |
| elastic |
Entra ID Register Device with Phishing Kit or ROADtools User Agent |
production |
2026-10-07 |
| elastic |
OpenAI ChatGPT Enterprise Codex Access Token Created |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Domain Created |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise App Authentication Linked |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Account Owner Role Assigned |
production |
2026-10-06 |
| elastic |
Modification of the msPKIAccountCredentials |
production |
2026-10-06 |
| elastic |
User account exposed to Kerberoasting |
production |
2026-10-06 |
| elastic |
M365 SharePoint Site Administrator Added |
production |
2026-10-06 |
| elastic |
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted |
production |
2026-10-06 |
| elastic |
AWS Bedrock Unauthorized Foundation Model Access Attempt |
production |
2026-10-06 |
| splunk |
Windows AD DSRM Password Reset |
production |
2026-10-02 |
| elastic |
Entra ID Federated Identity Credential Modified |
production |
2026-10-01 |
| elastic |
ESXi Account Granted Admin Role |
production |
2026-09-30 |
| elastic |
ESXi Root Password Changed |
production |
2026-09-30 |
| elastic |
Anthropic Organization Domain Boundary Changed |
production |
2026-09-25 |
| elastic |
AWS IAM Credentials Added to a Bedrock API Key Phantom User |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
AWS Bedrock Resource-Based Policy Modified or Deleted |
production |
2026-09-25 |
| elastic |
AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt |
production |
2026-09-25 |
| elastic |
Anthropic Sensitive Claude Project Role Assigned to User |
production |
2026-09-25 |
| elastic |
Anthropic Admin API Key Created |
production |
2026-09-25 |
| elastic |
Anthropic Compliance API Key Created |
production |
2026-09-25 |
| elastic |
Google Workspace Object Copied from External Drive with App Consent |
production |
2026-09-24 |
| splunk |
Windows AD Self DACL Assignment |
production |
2026-09-22 |
| splunk |
Windows AD Privileged Group Modification |
production |
2026-09-22 |
| elastic |
Kubernetes Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
GKE RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
GKE Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
GKE Service Account Modified RBAC Objects |
production |
2026-09-18 |
| elastic |
GKE Unusual Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
New GitHub App Installed |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
GitHub Owner Role Granted To User |
production |
2026-09-18 |
| elastic |
External User Added to Google Workspace Group |
production |
2026-09-18 |
| elastic |
Google Workspace Suspended User Account Renewed |
production |
2026-09-18 |
| elastic |
Application Added to Google Workspace Domain |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Assigned to a User or Group |
production |
2026-09-18 |
| elastic |
Google Workspace API Access Granted via Domain-Wide Delegation |
production |
2026-09-18 |
| elastic |
Google Workspace Custom Admin Role Created |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration After OAuth from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Google Workspace User Sign-in from Atypical Device Type |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
Google Workspace Password Policy Modified |
production |
2026-09-18 |
| elastic |
Google Workspace Role Modified |
production |
2026-09-18 |
| elastic |
Google Workspace User Organizational Unit Changed |
production |
2026-09-18 |
| elastic |
Kubernetes Cluster-Admin Role Binding Created |
production |
2026-09-18 |
| elastic |
EKS Authentication Configuration Modified |
production |
2026-09-18 |
| elastic |
Kubernetes Creation or Modification of Sensitive Role |
production |
2026-09-18 |
| elastic |
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
Kubernetes RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
Unusual Kubernetes Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Modified RBAC Objects |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by User Sign-in to Device Registration |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Audit Logging Bypass Added |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Illicit Consent Grant by Rare Client and User |
production |
2026-09-18 |
| elastic |
M365 Identity Global Administrator Role Assigned |
production |
2026-09-18 |
| elastic |
M365 Exchange Management Group Role Assigned |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox High-Risk Permission Delegated |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Teams Guest Access Enabled |
production |
2026-09-18 |
| elastic |
Administrator Privileges Assigned to an Okta Group |
production |
2026-09-18 |
| elastic |
Okta User Assigned Administrator Role |
production |
2026-09-18 |
| elastic |
Attempt to Create Okta API Token |
production |
2026-09-18 |
| elastic |
Attempt to Reset MFA Factors for an Okta User Account |
production |
2026-09-18 |
| elastic |
Spike in Group Application Assignment Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Lifecycle Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Membership Events |
production |
2026-09-18 |
| elastic |
Spike in Group Privilege Change Events |
production |
2026-09-18 |
| elastic |
Spike in User Lifecycle Management Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Management Events |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Unusual Privilege Type assigned to a User |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Potential Linux Backdoor User Account Creation |
production |
2026-09-18 |
| elastic |
Linux Group Creation |
production |
2026-09-18 |
| elastic |
Shadow File Modification by Unusual Process |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Linux User Account Credential Modification |
production |
2026-09-18 |
| elastic |
User or Group Creation/Modification |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Potential Admin Group Account Addition |
production |
2026-09-18 |
| elastic |
User Added to the Admin Group |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET SSH Authorized Key Injection |
production |
2026-09-18 |
| elastic |
Potential Active Directory Replication Account Backdoor |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| elastic |
Sensitive Privilege SeEnableDelegationPrivilege assigned to a Principal |
production |
2026-09-18 |
| elastic |
Potential Shadow Credentials added to AD Object |
production |
2026-09-18 |
| elastic |
AdminSDHolder Backdoor |
production |
2026-09-18 |
| elastic |
Account Configured with Never-Expiring Password |
production |
2026-09-18 |
| elastic |
Active Directory Group Modification by SYSTEM |
production |
2026-09-18 |
| elastic |
KRBTGT Delegation Backdoor |
production |
2026-09-18 |
| elastic |
New ActiveSyncAllowedDeviceID Added via PowerShell |
production |
2026-09-18 |
| elastic |
Account Password Reset Remotely |
production |
2026-09-18 |
| elastic |
AdminSDHolder SDProp Exclusion Added |
production |
2026-09-18 |
| elastic |
User Added to Privileged Group in Active Directory |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
Potential Privileged Escalation via SamAccountName Spoofing |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Activity |
production |
2026-09-18 |
| elastic |
AWS IAM User Addition to Group |
production |
2026-09-18 |
| elastic |
AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity |
production |
2026-09-18 |
| elastic |
AWS First Occurrence of STS GetFederationToken Request by User |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Created Then Deleted by Same Identity |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Modified |
production |
2026-09-18 |
| elastic |
AWS IAM API Calls via Temporary Session Tokens |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Added for Root |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Created or Modified for an IAM User |
production |
2026-09-18 |
| elastic |
AWS IAM Roles Anywhere Profile Creation |
production |
2026-09-18 |
| elastic |
AWS IAM Roles Anywhere Trust Anchor Created with External CA |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
AWS SES Full Access Policy Attached to IAM Entity by Unusual User |
production |
2026-09-18 |
| elastic |
AWS IAM User Created Access Keys For Another User |
production |
2026-09-18 |
| elastic |
AWS IAM User Self-Created Access Key Subsequently Used |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
AWS Organizations Delegated Administrator Registered |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Password Modified |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transferred to Another Account |
production |
2026-09-18 |
| elastic |
AWS Route 53 Private Hosted Zone Associated With a VPC |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Granted Cluster Admin Policy |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Group |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Role |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to User |
production |
2026-09-18 |
| elastic |
AWS IAM Customer-Managed Policy Attached to Role by Rare User |
production |
2026-09-18 |
| elastic |
AWS IAM Customer Managed Policy Version Created or Default Version Set |
production |
2026-09-18 |
| elastic |
AWS IAM Inline Policy Added to a Group |
production |
2026-09-18 |
| elastic |
AWS IAM Permissions Boundary Modified or Removed |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRoot by Rare User and Member Account |
production |
2026-09-18 |
| elastic |
Entra ID Sharepoint or OneDrive Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Azure VM Extension Deployment by User |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Guest Account Promoted to Member |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Entra ID Global Administrator Role Assigned (PIM User) |
production |
2026-09-18 |
| elastic |
Entra ID Privileged Identity Management (PIM) Role Modified |
production |
2026-09-18 |
| elastic |
Entra ID Register Device with Unusual User Agent (Azure AD Join) |
production |
2026-09-18 |
| elastic |
Entra ID Device Registration with ROADtools Default OS Build |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID ADRS Token Request by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Unusual Cloud Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Registered Application Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello for Business Credential Registered |
production |
2026-09-18 |
| elastic |
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID Elevated Access to User Access Administrator |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Rolebindings Created |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Recommended Monitor |
production |
2026-09-18 |
| elastic |
Entra ID Phishing Kit Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Entra ID Device with ROADtools Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Permissions Modification |
production |
2026-09-18 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request Self-Approved |
production |
2026-09-18 |
| elastic |
GKE Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
GKE Cluster-Admin Role Binding Created or Modified |
production |
2026-09-18 |
| elastic |
GKE Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
GKE Creation or Modification of Sensitive Role |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Key Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Key Creation |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Impersonation Role Granted |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request API Client Signer Requested |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request for Privileged Identity |
production |
2026-09-18 |
| elastic |
AWS IAM Assume Role Policy Update |
production |
2026-09-17 |
| elastic |
Azure RBAC Built-In Administrator Roles Assigned |
production |
2026-09-17 |
| sigma |
AWS IAM Backdoor Users Keys |
test |
2026-08-14 |
| splunk |
Linux Usermod Root UID Set |
production |
2026-07-08 |
| splunk |
Windows AD add Self to Group |
production |
2026-06-01 |
| splunk |
Windows Increase in Group or Object Modification Activity |
production |
2026-05-13 |
| splunk |
Windows Increase in User Modification Activity |
production |
2026-05-13 |
| splunk |
Windows Multiple Account Passwords Changed |
production |
2026-05-13 |
| splunk |
Windows Multiple Accounts Deleted |
production |
2026-05-13 |
| splunk |
Windows Multiple Accounts Disabled |
production |
2026-05-13 |
| splunk |
Cisco Configuration Archive Logging Analysis |
production |
2026-05-13 |
| splunk |
Windows AD DSRM Account Changes |
production |
2026-05-13 |
| splunk |
Windows AD ServicePrincipalName Added To Domain Account |
production |
2026-05-13 |
| splunk |
Windows AD Short Lived Domain Account ServicePrincipalName |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
Windows DnsAdmins New Member Added |
production |
2026-05-13 |
| splunk |
O365 Application Registration Owner Added |
production |
2026-05-13 |
| splunk |
Azure AD User ImmutableId Attribute Updated |
production |
2026-05-13 |
| splunk |
Azure AD User Enabled And Password Reset |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal Owner Added |
production |
2026-05-13 |
| splunk |
AWS IAM Successful Group Deletion |
production |
2026-05-13 |
| splunk |
AWS IAM Failure Group Deletion |
production |
2026-05-13 |
| splunk |
AWS IAM Delete Policy |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Successful Group Deletion |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Failure Group Deletion |
production |
2026-05-13 |
| splunk |
ASL AWS IAM Delete Policy |
production |
2026-05-13 |
| splunk |
ESXi User Granted Admin Role |
production |
2026-05-13 |
| splunk |
ESXi Account Modified |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Privilege Level Change |
production |
2026-05-13 |
| sigma |
Password Set to Never Expire via WMI |
experimental |
2025-07-30 |
| sigma |
DMSA Service Account Created in Specific OUs - PowerShell |
experimental |
2025-05-24 |
| sigma |
New DMSA Service Account Created in Specific OUs |
experimental |
2025-05-24 |
| sigma |
DMSA Link Attributes Modified |
experimental |
2025-05-24 |
| sigma |
Privileged User Has Been Created |
test |
2025-01-21 |
| sigma |
AWS User Login Profile Was Modified |
test |
2024-04-26 |
| sigma |
Active Directory User Backdoors |
test |
2024-02-26 |
| sigma |
Bitbucket Global Permission Changed |
test |
2024-02-25 |
| sigma |
User Added To Highly Privileged Group |
test |
2024-02-23 |
| sigma |
A New Trust Was Created To A Domain |
stable |
2024-01-16 |
| sigma |
GCP Access Policy Deleted |
test |
2024-01-12 |
| sigma |
Google Workspace User Granted Admin Privileges |
test |
2023-10-11 |
| sigma |
Number Of Resource Creation Or Deployment Activities |
test |
2023-10-11 |
| sigma |
Google Workspace Granted Domain API Access |
test |
2023-10-11 |
| sigma |
ESXi Admin Permission Assigned To Account Via ESXCLI |
test |
2023-09-04 |
| sigma |
Anomalous User Activity |
test |
2023-09-03 |
| sigma |
A Member Was Removed From a Security-Enabled Global Group |
stable |
2023-04-26 |
| sigma |
A Security-Enabled Global Group Was Deleted |
stable |
2023-04-26 |
| sigma |
A Member Was Added to a Security-Enabled Global Group |
stable |
2023-04-26 |
| sigma |
User Added to Local Administrators Group |
test |
2023-03-02 |
| elastic |
Google Workspace User Group Access Modified to Allow External Access |
deprecated |
2023-02-16 |
| sigma |
Cisco Local Accounts |
test |
2023-01-04 |
| sigma |
Suspicious Computer Account Name Change CVE-2021-42287 |
test |
2022-12-25 |
| sigma |
Change to Authentication Method |
test |
2022-12-25 |
| sigma |
AWS Route 53 Domain Transferred to Another Account |
test |
2022-10-09 |
| sigma |
AWS Route 53 Domain Transfer Lock Disabled |
test |
2022-10-09 |
| sigma |
Powerview Add-DomainObjectAcl DCSync AD Extend Right |
test |
2022-08-16 |
| sigma |
Bulk Deletion Changes To Privileged Account Permissions |
test |
2022-08-05 |
| sigma |
Powershell LocalAccount Manipulation |
test |
2021-12-28 |
| sigma |
Enabled User Right in AD to Control User Objects |
test |
2021-12-02 |
| sigma |
User Added to Local Administrator Group |
stable |
2021-01-17 |
| sigma |
Password Change on Directory Service Restore Mode (DSRM) Account |
stable |
2020-08-23 |
| sentinel |
User account added to built in domain local or global group |
Scheduled |
— |
| sentinel |
User account created and deleted within 10 mins |
Scheduled |
— |
| sentinel |
User account enabled and disabled within 10 mins |
Scheduled |
— |
| sentinel |
New user created and added to the built-in administrators group |
Scheduled |
— |
| sentinel |
AD account with Don't Expire Password |
Scheduled |
— |
| sentinel |
External User Access Enabled |
Scheduled |
— |
| sentinel |
Anomalous login followed by Teams action |
Scheduled |
— |
| sentinel |
High risk Office operation conducted by IP Address that recently attempted to log into a disabled account |
Scheduled |
— |
| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
NRT Malicious Inbox Rule |
NRT |
— |
| sentinel |
User State changed from Guest to Member |
Scheduled |
— |
| sentinel |
Detect PIM Alert Disabling activity |
Scheduled |
— |
| sentinel |
DSRM Account Abuse |
Scheduled |
— |
| sentinel |
Group created then added to built in domain local or global group |
Scheduled |
— |
| sentinel |
Account added and removed from privileged groups |
Scheduled |
— |