| elastic |
AWS Bedrock Model Invocation From High Number of Countries |
production |
2026-10-23 |
| elastic |
AWS Bedrock Model Invocation Impossible Travel |
production |
2026-10-23 |
| elastic |
GCP Vertex AI Caller Impossible Travel |
production |
2026-10-07 |
| elastic |
GCP Vertex AI Caller Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
Microsoft Foundry Subscription Key Impossible Travel |
production |
2026-10-05 |
| elastic |
Entra ID End-User Consent to Application with High-Risk Delegated Scopes |
production |
2026-10-02 |
| splunk |
Azure AD OAuth Application Consent Granted By User |
production |
2026-09-24 |
| splunk |
Azure AD User Consent Blocked for Risky Application |
production |
2026-09-24 |
| elastic |
GitHub OAuth Application Authorized |
production |
2026-09-24 |
| elastic |
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP |
production |
2026-09-22 |
| elastic |
Entra ID OAuth Application Redirect URI Modified |
production |
2026-09-18 |
| elastic |
Entra ID Illicit Consent Grant via Registered Application |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Registered Application Owner |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by User Sign-in to Device Registration |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Illicit Consent Grant by Rare Client and User |
production |
2026-09-18 |
| elastic |
M365 Identity Unusual SSO Authentication Errors for User |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Kubernetes and Cloud Credential Path Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Secret Access |
production |
2026-09-18 |
| elastic |
Potential Entra ID PRT Extraction via BrowserCore |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Potential Impersonation Attempt via Kubectl |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Azure AKS Service Account Token Created via TokenRequest API |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Flow with Concurrent Sign-ins |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| splunk |
Windows Cloud Sensitive File Read Access By Uncommon Process |
production |
2026-08-19 |
| splunk |
O365 File Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 Mail Permissioned Application Consent Granted by User |
production |
2026-05-13 |
| splunk |
O365 User Consent Blocked for Risky Application |
production |
2026-05-13 |
| splunk |
O365 User Consent Denied for OAuth Application |
production |
2026-05-13 |
| splunk |
Azure AD Device Code Authentication |
production |
2026-05-13 |
| splunk |
Azure AD User Consent Denied for OAuth Application |
production |
2026-05-13 |
| sigma |
Potentially Suspicious JWT Token Search Via CLI |
test |
2025-10-21 |
| sigma |
Microsoft Teams Sensitive File Access By Uncommon Applications |
test |
2024-07-22 |
| sigma |
Potentially Suspicious Command Targeting Teams Sensitive Files |
test |
2023-12-18 |
| sigma |
Primary Refresh Token Access Attempt |
test |
2023-09-07 |
| sigma |
Anonymous IP Address |
test |
2023-08-22 |
| sigma |
HackTool - Koh Default Named Pipe |
test |
2023-08-07 |
| sigma |
Anomalous Token |
test |
2023-08-07 |
| sigma |
Renamed BrowserCore.EXE Execution |
test |
2023-02-03 |
| sigma |
Suspicious Teams Application Related ObjectAcess Event |
test |
2022-09-16 |
| sigma |
Delegated Permissions Granted For All Users |
test |
2022-07-28 |
| sigma |
End User Consent |
test |
2022-07-28 |
| sigma |
App Granted Microsoft Permissions |
test |
2022-07-10 |
| sigma |
End User Consent Blocked |
test |
2022-07-10 |
| sigma |
Application URI Configuration Changes |
test |
2022-06-02 |
| sentinel |
Trust Monitor Event |
Scheduled |
— |