| elastic |
Multiple Credential Access by VS Code or Cursor IDE Descendant |
production |
2026-10-26 |
| elastic |
Microsoft Foundry Keys or Connection Secrets Accessed by New Principal |
production |
2026-10-23 |
| elastic |
First Time Python Accessed Sensitive Credential Files |
production |
2026-09-29 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| elastic |
Potential Veeam Credential Access Command |
production |
2026-09-18 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Web Browser Sensitive File Access |
production |
2026-09-18 |
| elastic |
SystemKey Access via Command Line |
production |
2026-09-18 |
| elastic |
Browser Process Spawned from an Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
PowerShell Script with Veeam Credential Access Capabilities |
production |
2026-09-18 |
| elastic |
Protected Storage Service Access via SMB |
production |
2026-09-18 |
| elastic |
Multiple Vault Web Credentials Read |
production |
2026-09-18 |
| elastic |
Searching for Saved Credentials via VaultCmd |
production |
2026-09-18 |
| elastic |
Veeam Backup Library Loaded by Unusual Process |
production |
2026-09-18 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
Multiple Cloud Secrets Accessed by Source Address |
production |
2026-09-18 |
| elastic |
Credential Access via TruffleHog Execution |
production |
2026-09-18 |
| elastic |
First Time Seen AWS Secret Value Accessed in Secrets Manager |
production |
2026-09-18 |
| elastic |
AWS Secrets Manager Rapid Secrets Retrieval |
production |
2026-09-18 |
| elastic |
AWS Systems Manager SecureString Parameter Request with Decryption Flag |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
Azure Storage Account Keys Accessed by Privileged User |
production |
2026-09-18 |
| elastic |
Azure Key Vault Excessive Secret or Key Retrieved |
production |
2026-09-18 |
| elastic |
Azure Key Vault Unusual Secret Key Usage |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Recommended Monitor |
production |
2026-09-18 |
| elastic |
Keychain CommandLine Interaction via Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Dumping of Keychain Content via Security Command |
production |
2026-09-18 |
| splunk |
Windows Credentials from Password Stores Creation |
production |
2026-05-13 |
| splunk |
Windows Credentials from Password Stores Query |
production |
2026-05-13 |
| splunk |
Windows Credentials from Password Stores Deletion |
production |
2026-05-13 |
| splunk |
MCP Postgres Suspicious Query |
production |
2026-05-13 |
| sigma |
PUA - AWS TruffleHog Execution |
experimental |
2025-10-21 |
| sigma |
DPAPI Backup Keys And Certificate Export Activity IOC |
test |
2024-06-26 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
HackTool - SecurityXploded Execution |
stable |
2023-02-04 |
| sigma |
Enumerate Credentials from Windows Credential Manager With PowerShell |
test |
2022-12-25 |
| sigma |
Dump Credentials from Windows Credential Manager With PowerShell |
test |
2022-12-25 |
| sigma |
Suspicious Serv-U Process Pattern |
test |
2022-07-14 |
| sentinel |
Trust Monitor Event |
Scheduled |
— |