| elastic |
Multiple Credential Access by VS Code or Cursor IDE Descendant |
production |
2026-10-26 |
| elastic |
Package Runtime Secret File Access Followed by IMDS Request |
production |
2026-10-23 |
| elastic |
AWS EKS Pod Exec Sensitive File or Credential Path Access |
production |
2026-10-20 |
| elastic |
Security File Access via Common Utilities |
production |
2026-10-09 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| splunk |
Potential password in username |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-22 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Credential Access via TruffleHog Execution |
production |
2026-09-18 |
| elastic |
Web Server Local File Inclusion Activity |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
AWS S3 Credential File Retrieved from Bucket |
production |
2026-09-18 |
| elastic |
Cloud Credential Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive File Compression Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Read Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-18 |
| elastic |
Sensitive Identity File Open by Suspicious Process via Auditd |
production |
2026-09-18 |
| elastic |
AWS Credentials Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression Inside A Container |
production |
2026-09-18 |
| elastic |
Kubernetes and Cloud Credential Path Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Secret Access |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Kubeconfig File Discovery |
production |
2026-09-18 |
| elastic |
Private Key Searching Activity |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
FortiGate Configuration File Downloaded |
production |
2026-09-18 |
| elastic |
Microsoft IIS Service Account Password Dumped |
production |
2026-09-18 |
| elastic |
Microsoft IIS Connection Strings Decryption |
production |
2026-09-18 |
| elastic |
Unusual Web Config File Access |
production |
2026-09-18 |
| splunk |
Windows WinSCP Configuration Security Access |
production |
2026-07-22 |
| splunk |
Windows Unusual FileZilla XML Config Access |
production |
2026-06-25 |
| splunk |
Shai-Hulud 2 Exfiltration Artifact Files |
production |
2026-05-13 |
| splunk |
Windows Unusual Intelliform Storage Registry Access |
production |
2026-05-13 |
| splunk |
MCP Github Suspicious Operation |
production |
2026-05-13 |
| splunk |
MCP Sensitive System File Search |
production |
2026-05-13 |
| sigma |
Shai-Hulud Malicious GitHub Workflow Creation |
experimental |
2026-01-24 |
| sigma |
Potentially Suspicious JWT Token Search Via CLI |
test |
2025-10-21 |
| sigma |
PUA - TruffleHog Execution - Linux |
experimental |
2025-09-24 |
| sigma |
PUA - TruffleHog Execution |
experimental |
2025-09-24 |
| sigma |
Potential PowerShell Console History Access Attempt via History File |
experimental |
2025-04-03 |
| sigma |
Hidden Flag Set On File/Directory Via Chflags - MacOS |
test |
2024-08-21 |
| sigma |
Unattend.XML File Access Attempt |
test |
2024-07-22 |
| sigma |
HackTool - Typical HiveNightmare SAM File Export |
test |
2024-06-27 |
| sigma |
Remote File Download Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
Insensitive Subfolder Search Via Findstr.EXE |
test |
2024-03-05 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
Potential Password Reconnaissance Via Findstr.EXE |
test |
2023-05-18 |
| sigma |
Credentials In Files - Linux |
test |
2023-04-30 |
| sigma |
Potential Russian APT Credential Theft Activity |
stable |
2023-03-08 |
| sigma |
Copy Passwd Or Shadow From TMP Path |
test |
2023-01-31 |
| sigma |
Cisco Collect Data |
test |
2023-01-04 |
| sigma |
Extracting Information with PowerShell |
test |
2022-12-25 |
| sigma |
Automated Collection Command Prompt |
test |
2022-11-11 |
| sigma |
Azure Keyvault Key Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Key Vault Modified or Deleted |
test |
2022-08-23 |
| sigma |
Azure Keyvault Secrets Modified or Deleted |
test |
2022-08-23 |
| sigma |
Linux Recon Indicators |
test |
2022-06-20 |
| sigma |
Credentials In Files |
test |
2021-11-27 |