| elastic |
AWS EKS API Server Proxying Request to Kubelet |
production |
2026-10-20 |
| elastic |
Okta AiTM Session Cookie Replay |
production |
2026-10-06 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
Entra ID Device-Bound PRT Replay via First-Party App from Unusual IP |
production |
2026-09-22 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
Unusual Process Connection to Docker or Containerd Socket |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
Potential Kerberos Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Kerberos Traffic from Unusual Process |
production |
2026-09-18 |
| elastic |
Potential PowerShell Pass-the-Hash/Relay Script |
production |
2026-09-18 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
Potential Pass-the-Hash (PtH) Attempt |
production |
2026-09-18 |
| elastic |
Suspicious Kerberos Authentication Ticket Request |
production |
2026-09-18 |
| elastic |
Potential Impersonation Attempt via Kubectl |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
AWS First Occurrence of STS GetFederationToken Request by User |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by Service |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by User |
production |
2026-09-18 |
| elastic |
AWS STS GetFederationToken with AdministratorAccess in Request |
production |
2026-09-18 |
| elastic |
AWS STS Role Chaining |
production |
2026-09-18 |
| elastic |
Microsoft Graph Email Access by Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual Client and User |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth User Impersonation to Microsoft Graph |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID ADRS Token Request by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
First Time Seen Google Workspace OAuth Login from Third-Party Application |
production |
2026-09-18 |
| elastic |
Kubernetes API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device) |
production |
2026-09-18 |
| elastic |
Multiple Device Token Hashes for Single Okta Session |
production |
2026-09-18 |
| elastic |
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials |
production |
2026-09-18 |
| elastic |
Multiple Okta Sessions Detected for a Single User |
production |
2026-09-18 |
| splunk |
AWS Bedrock Invoke Model Access Denied |
production |
2026-05-13 |
| splunk |
Unknown Process Using The Kerberos Protocol |
production |
2026-05-13 |
| splunk |
Windows AD Suspicious Attribute Modification |
production |
2026-05-13 |
| splunk |
Windows Steal Authentication Certificates - ESC1 Authentication |
production |
2026-05-13 |
| splunk |
Kerberos TGT Request Using RC4 Encryption |
production |
2026-05-13 |
| sigma |
AWS Suspicious SAML Activity |
test |
2022-12-18 |
| sigma |
AWS STS AssumeRole Misuse |
test |
2022-10-09 |
| sigma |
AWS STS GetSessionToken Misuse |
test |
2022-10-09 |
| sigma |
Outgoing Logon with New Credentials |
test |
2022-04-06 |