| elastic |
Scheduled Task Execution at Scale via GPO |
production |
2026-10-06 |
| elastic |
Startup/Logon Script added to Group Policy Object |
production |
2026-10-06 |
| elastic |
Google Workspace Bitlocker Setting Disabled |
production |
2026-10-06 |
| elastic |
Entra ID Federated Identity Credential Modified |
production |
2026-10-01 |
| splunk |
Windows AD Dangerous Group ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD Dangerous User ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD DCShadow Privileges ACL Addition |
production |
2026-09-22 |
| splunk |
Windows AD Domain Replication ACL Addition |
production |
2026-09-22 |
| splunk |
Windows AD Domain Root ACL Deletion |
production |
2026-09-22 |
| splunk |
Windows AD Domain Root ACL Modification |
production |
2026-09-22 |
| splunk |
Windows AD Hidden OU Creation |
production |
2026-09-22 |
| splunk |
Windows AD Object Owner Updated |
production |
2026-09-22 |
| splunk |
Windows AD Self DACL Assignment |
production |
2026-09-22 |
| splunk |
Windows AD Dangerous Deny ACL Modification |
production |
2026-09-22 |
| elastic |
M365 Exchange Malware Filter Rule Modified |
production |
2026-09-18 |
| elastic |
M365 SharePoint Site Sharing Policy Weakened |
production |
2026-09-18 |
| elastic |
M365 Teams Custom Application Interaction Enabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Teams External Access Enabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Teams Guest Access Enabled |
production |
2026-09-18 |
| elastic |
M365 Exchange Federated Domain Created or Modified |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
AdminSDHolder SDProp Exclusion Added |
production |
2026-09-18 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
Group Policy Abuse for Privilege Addition |
production |
2026-09-18 |
| elastic |
New Okta Identity Provider (IdP) Added by Admin |
production |
2026-09-18 |
| elastic |
AWS IAM OIDC Provider Created by Rare User |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
AWS Organizations Delegated Administrator Registered |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Updated |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Domain Added to Google Workspace Trusted Domains |
production |
2026-09-18 |
| elastic |
Google Workspace Restrictions for Marketplace Modified to Allow Any App |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Deletion |
production |
2026-09-18 |
| elastic |
Google Workspace Password Policy Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange DKIM Signing Configuration Disabled |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Link Policy Disabled |
production |
2026-09-18 |
| splunk |
Active Directory Privilege Escalation Identified |
experimental |
2026-05-13 |
| splunk |
Microsoft Intune DeviceManagementConfigurationPolicies |
production |
2026-05-13 |
| sigma |
Changes to Device Registration Policy |
test |
2022-06-28 |