| elastic |
Package Runtime Secret File Access Followed by IMDS Request |
production |
2026-10-23 |
| splunk |
Windows PowerShell Export PfxCertificate |
production |
2026-10-09 |
| splunk |
Windows PowerShell Export Certificate |
production |
2026-10-09 |
| splunk |
Windows Export Certificate |
production |
2026-10-09 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
Kubelet Certificate File Access Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Search Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User |
production |
2026-09-18 |
| elastic |
Private Key Searching Activity |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Linux DAC permissions |
production |
2026-09-18 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Protected Storage Service Access via SMB |
production |
2026-09-18 |
| elastic |
Suspicious CertUtil Commands |
production |
2026-09-18 |
| splunk |
Windows Private Keys Discovery |
production |
2026-08-31 |
| splunk |
Linux Auditd Private Keys and Certificate Enumeration |
production |
2026-05-13 |
| splunk |
Linux Auditd Find Ssh Private Keys |
production |
2026-05-13 |
| sigma |
PFX File Creation |
test |
2025-10-19 |
| sigma |
DPAPI Backup Keys And Certificate Export Activity IOC |
test |
2024-06-26 |
| sigma |
Certificate Exported Via PowerShell |
test |
2023-05-18 |
| sigma |
Certificate Exported Via PowerShell - ScriptBlock |
test |
2023-05-18 |
| sigma |
Private Keys Reconnaissance Via CommandLine Tools |
test |
2023-03-06 |
| sigma |
PowerShell Get-Process LSASS |
test |
2023-01-05 |
| sigma |
Cisco Crypto Commands |
test |
2023-01-04 |