| elastic |
Potential Destructive AWS CLI Command Executed by GenAI Agent |
production |
2026-10-23 |
| elastic |
Anthropic Admin API Key Deleted |
production |
2026-09-25 |
| elastic |
Anthropic Organization Deletion |
production |
2026-09-25 |
| elastic |
AWS Attempt to Leave Organization |
production |
2026-09-18 |
| elastic |
AWS Account Closed |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS IAM Group Deletion |
production |
2026-09-18 |
| elastic |
GCP IAM Role Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Deletion |
production |
2026-09-18 |
| elastic |
GCP Service Account Disabled |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Key Deletion |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Deletion |
production |
2026-09-18 |
| elastic |
Google Workspace MFA Enforcement Disabled For Organization |
production |
2026-09-18 |
| elastic |
Attempt to Revoke Okta API Token |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Linux User or Group Deletion |
production |
2026-09-18 |
| elastic |
Account Password Reset Remotely |
production |
2026-09-18 |
| splunk |
Windows Powershell Logoff User via Quser |
production |
2026-06-29 |
| splunk |
Windows User Disabled Via Net |
production |
2026-05-13 |
| splunk |
Windows User Deletion Via Net |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Deleted From Local Database |
production |
2026-05-13 |
| splunk |
Windows Excessive Usage Of Net App |
production |
2026-05-13 |
| splunk |
Windows Account Access Removal via Logoff Exec |
production |
2026-05-13 |
| sigma |
Okta User Account Locked Out |
test |
2026-04-27 |
| elastic |
Deprecated - AWS RDS Security Group Deletion |
deprecated |
2026-01-16 |
| sigma |
AWS SAML Provider Deletion Activity |
experimental |
2024-12-19 |
| sigma |
Group Has Been Deleted Via Groupdel |
test |
2022-12-26 |
| sigma |
User Has Been Deleted Via Userdel |
test |
2022-12-26 |
| sigma |
User Logoff Event |
test |
2022-10-14 |
| sigma |
AWS ElastiCache Security Group Modified or Deleted |
test |
2022-10-09 |
| sigma |
Google Cloud Service Account Disabled or Deleted |
test |
2022-10-09 |
| sigma |
Azure Kubernetes Service Account Modified or Deleted |
test |
2022-08-23 |
| sigma |
Remove Account From Domain Admin Group |
test |
2021-12-26 |