| elastic |
OpenAI ChatGPT Enterprise User Invite Sent |
production |
2026-10-09 |
| elastic |
OpenSSL Password Hash Generation |
production |
2026-10-09 |
| elastic |
Linux User Added to Privileged Group |
production |
2026-10-09 |
| splunk |
Windows Entra User Management Via Azure CLI |
production |
2026-10-09 |
| elastic |
ESXi Local Account Created |
production |
2026-09-30 |
| elastic |
Anthropic Organization User Invite Sent |
production |
2026-09-25 |
| elastic |
Linux User Account Creation |
production |
2026-09-22 |
| elastic |
User or Group Creation/Modification |
production |
2026-09-18 |
| elastic |
Linux Group Creation |
production |
2026-09-18 |
| elastic |
Shadow File Modification by Unusual Process |
production |
2026-09-18 |
| elastic |
Suspicious Passwd File Event Action |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Account Creation from Unusual Source |
production |
2026-09-18 |
| elastic |
FortiGate SSO Login Followed by Administrator Account Creation |
production |
2026-09-18 |
| elastic |
FortiGate Super Admin Account Creation |
production |
2026-09-18 |
| elastic |
Creation of a Hidden Local User Account |
production |
2026-09-18 |
| elastic |
User Account Creation |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
AWS IAM Create User via Assumed Role on EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Group Creation |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Created |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
GCP Service Account Creation |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
Attempt to Create Okta API Token |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Potential Linux Backdoor User Account Creation |
production |
2026-09-18 |
| splunk |
MacOS Account Created |
production |
2026-09-01 |
| splunk |
Cisco IOS Suspicious Privileged Account Creation |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| elastic |
Deprecated - AWS RDS Security Group Creation |
deprecated |
2026-01-16 |
| sigma |
New Kubernetes Service Account Created |
test |
2024-03-26 |
| sigma |
ESXi Account Creation Via ESXCLI |
test |
2023-08-22 |
| sigma |
AWS ElastiCache Security Group Created |
test |
2022-10-09 |
| sentinel |
Unusual identity creation using exchange powershell |
Scheduled |
— |
| sentinel |
Anomalous login followed by Teams action |
Scheduled |
— |