| elastic |
Pluggable Authentication Module (PAM) Version Discovery |
production |
2026-10-09 |
| elastic |
Potential OpenSSH Backdoor Logging Activity |
production |
2026-10-08 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-10-08 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-10-06 |
| elastic |
Entra ID Conditional Access Policy (CAP) Modified |
production |
2026-10-06 |
| elastic |
Anthropic Magic Link Second Factor Disabled |
production |
2026-09-25 |
| elastic |
Anthropic SSO Disabled or Connection Removed |
production |
2026-09-25 |
| elastic |
Untrusted DLL Loaded by Azure AD Connect Authentication Agent |
production |
2026-09-18 |
| elastic |
AWS IAM Roles Anywhere Trust Anchor Created with External CA |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance Made Public |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID MFA Disabled for User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Application Redirect URI Modified |
production |
2026-09-18 |
| elastic |
Entra ID External Authentication Methods (EAM) Modified |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Google Workspace MFA Enforcement Disabled For Organization |
production |
2026-09-18 |
| elastic |
Google Workspace 2SV Policy Disabled By User |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Reset MFA Factors for an Okta User Account |
production |
2026-09-18 |
| elastic |
MFA Deactivation with no Re-Activation for Okta User Account |
production |
2026-09-18 |
| elastic |
New Okta Identity Provider (IdP) Added by Admin |
production |
2026-09-18 |
| elastic |
Modification or Removal of an Okta Application Sign-On Policy |
production |
2026-09-18 |
| elastic |
Stolen Credentials Used to Login to Okta Account After MFA Reset |
production |
2026-09-18 |
| elastic |
Potential SSH Password Grabbing via strace |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module or Configuration Creation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Creation in Unusual Directory |
production |
2026-09-18 |
| elastic |
Potential Backdoor Execution Through PAM_EXEC |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Source Download |
production |
2026-09-18 |
| elastic |
Polkit Policy Creation |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Authentication via Unusual PAM Grantor |
production |
2026-09-18 |
| elastic |
Authorization Plugin Modification |
production |
2026-09-18 |
| elastic |
Mimikatz Memssp Log File Detected |
production |
2026-09-18 |
| elastic |
Network Logon Provider Registry Modification |
production |
2026-09-18 |
| elastic |
Potential Shadow Credentials added to AD Object |
production |
2026-09-18 |
| elastic |
AWS IAM Account Password Policy Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Deactivation of MFA Device |
production |
2026-09-18 |
| elastic |
AWS IAM Virtual MFA Device Registration Attempt with Session Token |
production |
2026-09-18 |
| elastic |
MFA Disabled for Google Workspace Organization |
deprecated |
2026-08-21 |
| splunk |
Cisco Network Interface Modifications |
production |
2026-05-13 |
| splunk |
Disabling Windows Local Security Authority Defences via Registry |
production |
2026-05-13 |
| splunk |
O365 Disable MFA |
production |
2026-05-13 |
| splunk |
Okta Phishing Detection with FastPass Origin Check |
experimental |
2026-05-13 |
| splunk |
O365 Excessive SSO logon errors |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Browser |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Country |
production |
2026-05-13 |
| splunk |
Cisco Duo Admin Login Unusual Os |
production |
2026-05-13 |
| splunk |
Cisco Duo Bulk Policy Deletion |
production |
2026-05-13 |
| splunk |
Cisco Duo Bypass Code Generation |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Devices Without Screen Lock |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Network Bypass 2FA |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Old Flash |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Old Java |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Tampered Devices |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Bypass 2FA |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Deny Access |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Skip 2FA for Other Countries |
production |
2026-05-13 |
| splunk |
Cisco Duo Set User Status to Bypass 2FA |
production |
2026-05-13 |
| sigma |
Disabled MFA to Bypass Authentication Mechanisms |
test |
2026-04-30 |
| elastic |
Deprecated - Modification of Standard Authentication Module or Configuration |
deprecated |
2026-02-04 |
| sigma |
Github High Risk Configuration Disabled |
test |
2024-07-22 |
| sigma |
Directory Service Restore Mode(DSRM) Registry Value Tampering |
test |
2024-07-11 |
| sigma |
CA Policy Updated by Non Approved Actor |
test |
2024-05-28 |
| sigma |
New Root Certificate Authority Added |
test |
2024-03-26 |
| sigma |
Certificate-Based Authentication Enabled |
test |
2024-03-26 |
| sigma |
AWS Identity Center Identity Provider Change |
test |
2023-09-27 |
| sigma |
Change to Authentication Method |
test |
2022-12-25 |
| sigma |
Possible Shadow Credentials Added |
test |
2022-10-17 |
| sigma |
User Added To Group With CA Policy Modification Access |
test |
2022-08-04 |
| sigma |
User Removed From Group With CA Policy Modification Access |
test |
2022-08-04 |
| sigma |
CA Policy Removed by Non Approved Actor |
test |
2022-07-19 |
| sentinel |
Excessive number of HTTP authentication failures from a source (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
External User Access Enabled |
Scheduled |
— |