| elastic |
Okta AiTM Session Cookie Replay |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise User Activity From High Number of Countries |
production |
2026-10-06 |
| elastic |
Anthropic User Activity From High Number of Countries |
production |
2026-10-05 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| elastic |
Anthropic Session Reuse Impossible Travel |
production |
2026-09-25 |
| elastic |
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP |
production |
2026-09-22 |
| elastic |
M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA) |
production |
2026-09-18 |
| elastic |
Multiple Device Token Hashes for Single Okta Session |
production |
2026-09-18 |
| elastic |
Okta Multiple OS Names Detected for a Single DT Hash |
production |
2026-09-18 |
| elastic |
Suspicious Web Browser Sensitive File Access |
production |
2026-09-18 |
| elastic |
Manual Loading of a Suspicious Chromium Extension |
production |
2026-09-18 |
| elastic |
Browser Process Spawned from an Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Entra ID PRT Extraction via BrowserCore |
production |
2026-09-18 |
| elastic |
WebProxy Settings Modification |
production |
2026-09-18 |
| elastic |
Potential Cookies Theft via Browser Debugging |
production |
2026-09-18 |
| elastic |
AWS IAM User Console Login from Multiple Geolocations |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) |
production |
2026-09-18 |
| splunk |
Okta Suspicious Use of a Session Cookie |
production |
2026-05-13 |
| sigma |
SQLite Chromium Profile Data DB Access |
test |
2023-01-19 |
| sigma |
SQLite Firefox Profile Data DB Access |
test |
2023-01-19 |