| elastic |
M365 Exchange MFA Notification Email Deleted or Moved |
production |
2026-10-20 |
| elastic |
Entra ID Register Device with Phishing Kit or ROADtools User Agent |
production |
2026-10-07 |
| elastic |
Entra ID Device Registration with Phishing Kit Default OS Build |
production |
2026-10-07 |
| splunk |
PingID New MFA Method After Credential Reset |
production |
2026-09-29 |
| elastic |
Entra ID Unusual Cloud Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID Phishing Kit Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Entra ID Device with ROADtools Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration After OAuth from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Google Workspace User Sign-in from Atypical Device Type |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by User Sign-in to Device Registration |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Entra ID Register Device with Unusual User Agent (Azure AD Join) |
production |
2026-09-18 |
| elastic |
Entra ID Device Registration with ROADtools Default OS Build |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID ADRS Token Request by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| splunk |
O365 New MFA Method Registered |
production |
2026-05-13 |
| splunk |
Azure AD New MFA Method Registered |
production |
2026-05-13 |
| splunk |
PingID New MFA Method Registered For User |
production |
2026-05-13 |
| splunk |
PingID Mismatch Auth Source and Verification Response |
production |
2026-05-13 |
| splunk |
Okta New Device Enrolled on Account |
production |
2026-05-13 |
| sigma |
Windows LAPS Credential Dump From Entra ID |
test |
2024-06-26 |