| elastic |
Azure AD Graph Potential Enumeration (ROADrecon) |
production |
2026-10-09 |
| elastic |
AWS Control Plane Access by Suspicious Process |
production |
2026-10-06 |
| elastic |
AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key |
production |
2026-10-06 |
| elastic |
Anthropic Excessive Chat Access Failures |
production |
2026-09-25 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
Spike in AWS Error Messages |
production |
2026-09-18 |
| elastic |
Rare AWS Error Code |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Azure AD Graph High 4xx Error Ratio from User |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Suspicious User-Agent |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in BloodHound Suite User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
Microsoft Graph Multi-Category Reconnaissance Burst |
production |
2026-09-18 |
| elastic |
Spike in Azure Activity Logs Failed Messages |
production |
2026-09-18 |
| elastic |
Rare Azure Activity Logs Event Failures |
production |
2026-09-18 |
| elastic |
GCP Secret Manager ListSecrets Across Multiple Projects |
production |
2026-09-18 |
| elastic |
Spike in GCP Audit Failed Messages |
production |
2026-09-18 |
| elastic |
Rare GCP Audit Failure Event Code |
production |
2026-09-18 |
| elastic |
AWS Backup Resource Enumeration via Long-Term Access Key |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls via CLI from a Single Resource |
production |
2026-09-18 |
| elastic |
AWS Discovery API Calls from VPN ASN for the First Time by Identity |
production |
2026-09-18 |
| elastic |
AWS S3 Rapid Bucket Posture API Calls from a Single Principal |
production |
2026-09-18 |
| elastic |
AWS Service Quotas Multi-Region GetServiceQuota Requests |
production |
2026-09-18 |
| elastic |
AWS SES Enumeration via Long-Term Access Key |
production |
2026-09-18 |
| elastic |
Unusual Process Resolving AWS ECS Agent Communication Service Endpoint |
production |
2026-09-14 |
| splunk |
Azure AD AzureHound UserAgent Detected |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal Enumeration |
production |
2026-05-13 |
| splunk |
GCP Kubernetes cluster pod scan detection |
experimental |
2026-05-13 |
| splunk |
Kubernetes Scanner Image Pulling |
production |
2026-05-13 |
| splunk |
Kubernetes Suspicious Image Pulling |
production |
2026-05-13 |
| splunk |
AWS Excessive Security Scanning |
production |
2026-05-13 |
| splunk |
Amazon EKS Kubernetes cluster scan detection |
experimental |
2026-05-13 |
| splunk |
Amazon EKS Kubernetes Pod scan detection |
experimental |
2026-05-13 |
| sigma |
PUA - Seatbelt Execution |
test |
2023-02-04 |
| sigma |
Github Self Hosted Runner Changes Detected |
test |
2023-01-27 |
| sigma |
Discovery Using AzureHound |
test |
2022-11-27 |
| sentinel |
Suspicious VM Instance Creation Activity Detected |
Scheduled |
— |