| elastic |
GCP Vertex AI Role Granted to Principal |
production |
2026-10-23 |
| elastic |
Entra ID Privileged Role Assigned to Another Account |
production |
2026-10-19 |
| elastic |
Entra ID Application Self-Assigned to Privileged Role |
production |
2026-10-19 |
| elastic |
Entra ID Global Administrator Role Assigned |
production |
2026-10-19 |
| splunk |
AWS IAM Role Created with External Trust |
production |
2026-10-13 |
| elastic |
Anthropic Admin Role Assigned to User |
production |
2026-10-07 |
| elastic |
Anthropic Primary Owner Transferred |
production |
2026-10-07 |
| elastic |
M365 SharePoint Site Administrator Added |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Account Owner Role Assigned |
production |
2026-10-06 |
| elastic |
Anthropic Sensitive Claude Project Role Assigned to User |
production |
2026-09-25 |
| splunk |
O365 Privileged Role Assigned To Service Principal |
production |
2026-09-22 |
| splunk |
O365 Privileged Role Assigned |
production |
2026-09-22 |
| splunk |
Azure AD Privileged Role Assigned to Service Principal |
production |
2026-09-22 |
| splunk |
Azure AD Privileged Role Assigned |
production |
2026-09-22 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
AWS IAM Roles Anywhere Profile Creation |
production |
2026-09-18 |
| elastic |
AWS IAM Roles Anywhere Trust Anchor Created with External CA |
production |
2026-09-18 |
| elastic |
AWS SES Full Access Policy Attached to IAM Entity by Unusual User |
production |
2026-09-18 |
| elastic |
AWS Organizations Delegated Administrator Registered |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Group |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to Role |
production |
2026-09-18 |
| elastic |
AWS IAM AdministratorAccess Policy Attached to User |
production |
2026-09-18 |
| elastic |
AWS IAM Inline Policy Added to a Group |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRoot by Rare User and Member Account |
production |
2026-09-18 |
| elastic |
Entra ID Global Administrator Role Assigned (PIM User) |
production |
2026-09-18 |
| elastic |
Entra ID Privileged Identity Management (PIM) Role Modified |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
Entra ID Elevated Access to User Access Administrator |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Permissions Modification |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Impersonation Role Granted |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
GitHub Owner Role Granted To User |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Assigned to a User or Group |
production |
2026-09-18 |
| elastic |
Google Workspace Custom Admin Role Created |
production |
2026-09-18 |
| elastic |
Google Workspace User Organizational Unit Changed |
production |
2026-09-18 |
| elastic |
M365 Identity Global Administrator Role Assigned |
production |
2026-09-18 |
| elastic |
M365 Exchange Management Group Role Assigned |
production |
2026-09-18 |
| elastic |
Administrator Privileges Assigned to an Okta Group |
production |
2026-09-18 |
| elastic |
Okta User Assigned Administrator Role |
production |
2026-09-18 |
| elastic |
AWS IAM User Addition to Group |
production |
2026-09-18 |
| elastic |
AWS IAM Assume Role Policy Update |
production |
2026-09-17 |
| elastic |
Azure RBAC Built-In Administrator Roles Assigned |
production |
2026-09-17 |
| splunk |
Azure AD Tenant Wide Admin Consent Granted |
production |
2026-05-13 |
| splunk |
O365 Admin Consent Bypassed by Service Principal |
production |
2026-05-13 |
| splunk |
O365 Application Available To Other Tenants |
production |
2026-05-13 |
| splunk |
O365 FullAccessAsApp Permission Assigned |
production |
2026-05-13 |
| splunk |
O365 High Privilege Role Granted |
production |
2026-05-13 |
| splunk |
O365 Mailbox Read Access Granted to Application |
production |
2026-05-13 |
| splunk |
O365 Service Principal Privilege Escalation |
production |
2026-05-13 |
| splunk |
O365 Tenant Wide Admin Consent Granted |
production |
2026-05-13 |
| splunk |
Azure AD Application Administrator Role Assigned |
production |
2026-05-13 |
| splunk |
Azure AD Admin Consent Bypassed by Service Principal |
production |
2026-05-13 |
| splunk |
Azure AD FullAccessAsApp Permission Assigned |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal Privilege Escalation |
production |
2026-05-13 |
| splunk |
Azure AD PIM Role Assigned |
production |
2026-05-13 |
| splunk |
Azure AD Global Administrator Role Assigned |
production |
2026-05-13 |
| splunk |
Azure AD PIM Role Assignment Activated |
production |
2026-05-13 |
| sigma |
User Added to an Administrator's Azure AD Role |
test |
2026-04-30 |
| sigma |
Okta Admin Role Assigned to an User or Group |
test |
2026-04-27 |
| sigma |
App Assigned To Azure RBAC/Microsoft Entra Role |
test |
2024-11-04 |
| sigma |
Google Workspace Application Access Level Modified |
test |
2024-01-12 |
| sigma |
Granting Of Permissions To An Account |
test |
2023-10-11 |
| sigma |
App Granted Privileged Delegated Or App Permissions |
test |
2023-03-29 |
| elastic |
Google Workspace User Group Access Modified to Allow External Access |
deprecated |
2023-02-16 |
| sigma |
Github Outside Collaborator Detected |
test |
2023-01-20 |