| elastic |
AWS EKS API Request Impersonating Privileged Identity |
production |
2026-10-20 |
| elastic |
Process Creation via Secondary Logon |
production |
2026-10-08 |
| elastic |
SeDebugPrivilege Enabled by a Suspicious Process |
production |
2026-10-06 |
| elastic |
Permission Theft - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Interactive Logon by an Unusual Process |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
First Time Seen NewCredentials Logon Process |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Suspicious SeIncreaseBasePriorityPrivilege Use |
production |
2026-09-18 |
| elastic |
Unusual Parent-Child Relationship |
production |
2026-09-18 |
| elastic |
Privileges Elevation via Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Rogue Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
Process Created with an Elevated Token |
production |
2026-09-18 |
| elastic |
GKE API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Credential Manipulation - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Credential Manipulation - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Permission Theft - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Process Created with a Duplicated Token |
production |
2026-09-18 |
| sigma |
Suspicious Cross-User Process Spawn |
experimental |
2026-07-23 |
| sigma |
Potentially Suspicious Explicit Credential Local Logon |
experimental |
2026-07-23 |
| splunk |
Windows Privilege Escalation System Process Without System Parent |
production |
2026-05-13 |
| splunk |
Windows Privilege Escalation User Process Spawn System Process |
production |
2026-05-13 |
| splunk |
Windows Privilege Escalation Suspicious Process Elevation |
production |
2026-05-13 |
| sigma |
Suspicious SYSTEM User Process Creation |
test |
2025-10-19 |
| sigma |
HackTool - NoFilter Execution |
test |
2024-01-05 |
| sentinel |
Service Principal Name (SPN) Assigned to User Account |
Scheduled |
— |
| sentinel |
Possible Resource-Based Constrained Delegation Abuse |
Scheduled |
— |