| elastic |
Multiple Credential Access by VS Code or Cursor IDE Descendant |
production |
2026-10-26 |
| elastic |
Package Runtime Secret File Access Followed by IMDS Request |
production |
2026-10-23 |
| elastic |
AWS EKS Pod Exec Cloud Instance Metadata Access |
production |
2026-10-20 |
| elastic |
AWS EKS Rapid Secret GET Activity Against Multiple Objects |
production |
2026-10-20 |
| elastic |
AWS EKS Secret get or list with Suspicious User Agent |
production |
2026-10-20 |
| elastic |
AWS EKS Pod Exec Sensitive File or Credential Path Access |
production |
2026-10-20 |
| elastic |
AWS EKS Service Account Token Created via TokenRequest API |
production |
2026-10-20 |
| elastic |
AWS EKS Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-10-20 |
| elastic |
AWS EKS Secret get or list from Node or Pod Service Account |
production |
2026-10-20 |
| elastic |
OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials |
production |
2026-10-16 |
| elastic |
OpenAI ChatGPT Enterprise Conversation Message Containing Credentials |
production |
2026-10-16 |
| elastic |
Security File Access via Common Utilities |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure |
production |
2026-10-09 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
Kubernetes Service Account Token Created via TokenRequest API |
production |
2026-10-06 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
AWS IAM CompromisedKeyQuarantine Policy Attached to User |
production |
2026-10-06 |
| elastic |
Microsoft Foundry Prompt or Completion Containing Credentials |
production |
2026-10-05 |
| elastic |
GCP Vertex AI Prompt or Response Containing Credentials |
production |
2026-10-02 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| elastic |
GKE Unusual Service Account Secret Access via New User Agent |
deprecated |
2026-09-29 |
| elastic |
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Runtime Prompt Containing Credentials |
production |
2026-09-25 |
| elastic |
AWS Bedrock Model Prompt or Completion Containing Credentials |
production |
2026-09-25 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| elastic |
Kubernetes Pod Exec Cloud Instance Metadata Access |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-22 |
| elastic |
Cloud Credential Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive File Compression Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Read Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubelet Certificate File Access Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Cloud Instance Metadata Access |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-18 |
| elastic |
GKE Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |
| elastic |
GKE Secret Access from Node or Denied Service Account |
production |
2026-09-18 |
| elastic |
GKE Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
GKE Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
GKE Secrets List from Unusual Source AS Organization |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User |
production |
2026-09-18 |
| elastic |
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List from Node or Pod Service Account |
production |
2026-09-18 |
| elastic |
Kubernetes Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-09-18 |
| elastic |
Sensitive Identity File Open by Suspicious Process via Auditd |
production |
2026-09-18 |
| elastic |
AWS Credentials Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression Inside A Container |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Kubernetes and Cloud Credential Path Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Secret Access |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Kubeconfig File Discovery |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Linux DAC permissions |
production |
2026-09-18 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Linux User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Windows Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Windows User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
FortiGate Configuration File Downloaded |
production |
2026-09-18 |
| elastic |
Azure WireServer HTTP Request from Unexpected User Agent |
production |
2026-09-18 |
| elastic |
Cloud Instance Metadata Credential Path HTTP Request |
production |
2026-09-18 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Microsoft IIS Service Account Password Dumped |
production |
2026-09-18 |
| elastic |
Microsoft IIS Connection Strings Decryption |
production |
2026-09-18 |
| elastic |
Protected Storage Service Access via SMB |
production |
2026-09-18 |
| elastic |
Unusual Web Config File Access |
production |
2026-09-18 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Suspicious CertUtil Commands |
production |
2026-09-18 |
| elastic |
Command Shell Activity Started via RunDLL32 |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Private Key Searching Activity |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| elastic |
Credential Access via TruffleHog Execution |
production |
2026-09-18 |
| elastic |
Web Server Cloud Metadata SSRF Request |
production |
2026-09-18 |
| elastic |
Potential Impersonation Attempt via Kubectl |
production |
2026-09-18 |
| elastic |
Kubectl Secrets Enumeration Across All Namespaces |
production |
2026-09-18 |
| elastic |
Web Server Local File Inclusion Activity |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role |
production |
2026-09-18 |
| elastic |
AWS Cognito Unauthenticated Identity Pool Credentials Issued |
production |
2026-09-18 |
| elastic |
AWS S3 Credential File Retrieved from Bucket |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key First Seen from Source IP |
production |
2026-09-18 |
| elastic |
AWS EC2 User Data Retrieval for EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
Azure AKS Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Azure VM Boot Diagnostics Retrieved |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| splunk |
Windows Unsecured Outlook Credentials Access In Registry |
production |
2026-09-08 |
| elastic |
GKE Service Account Token Created via TokenRequest API |
deprecated |
2026-08-21 |
| splunk |
Splunk Sensitive Information Disclosure in DEBUG Logging Channels |
production |
2026-05-14 |
| splunk |
Windows SharePoint Spinstall0 GET Request |
production |
2026-05-13 |
| splunk |
Cisco SNMP Community String Configuration Changes |
production |
2026-05-13 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows LAPS Password Gathering Via PowerShell Script |
production |
2026-05-13 |
| splunk |
O365 SharePoint Suspicious Search Behavior |
production |
2026-05-13 |
| splunk |
O365 Email Suspicious Search Behavior |
production |
2026-05-13 |
| splunk |
Detect AWS Console Login by New User |
production |
2026-05-13 |
| sigma |
Potential Okta Password in AlternateID Field |
test |
2026-04-27 |
| sigma |
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities |
test |
2025-12-02 |
| sigma |
Script Interpreter Spawning Credential Scanner - Windows |
experimental |
2025-11-25 |
| sigma |
Script Interpreter Spawning Credential Scanner - Linux |
experimental |
2025-11-25 |
| sigma |
Kubernetes Admission Controller Modification |
test |
2024-07-11 |
| sigma |
EventLog Query Requests By Builtin Utilities |
test |
2024-01-24 |
| sigma |
Azure Kubernetes Admission Controller |
test |
2022-12-18 |
| sigma |
Google Cloud Kubernetes Admission Controller |
test |
2022-12-18 |
| sigma |
Azure Keyvault Key Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Keyvault Secrets Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Key Vault Modified or Deleted |
test |
2022-08-23 |
| sigma |
Application AppID Uri Configuration Changes |
test |
2022-06-02 |
| sigma |
Added Owner To Application |
test |
2022-06-02 |
| sentinel |
AD FS Abnormal EKU object identifier attribute |
Scheduled |
— |