| elastic |
Multiple DHCP Servers Responding to the Same Transaction |
production |
2026-10-06 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
Potential WPAD Spoofing via DNS Record Creation |
production |
2026-09-18 |
| elastic |
Creation of a DNS-Named Record |
production |
2026-09-18 |
| elastic |
Potential Computer Account NTLM Relay Activity |
production |
2026-09-18 |
| elastic |
Potential Kerberos Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Potential NTLM Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Potential Kerberos Coercion via DNS-Based SPN Spoofing |
production |
2026-09-18 |
| elastic |
Potential Kerberos SPN Spoofing via Suspicious DNS Query |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Potential PowerShell Pass-the-Hash/Relay Script |
production |
2026-09-18 |
| elastic |
Potential Local NTLM Relay via HTTP |
production |
2026-09-18 |
| elastic |
Creation or Modification of Root Certificate |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Service Creation via Local Kerberos Authentication |
production |
2026-09-18 |
| elastic |
AWS Route 53 Private Hosted Zone Associated With a VPC |
production |
2026-09-18 |
| elastic |
Azure AKS CoreDNS or Kube-DNS Configuration Modified |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
WebProxy Settings Modification |
production |
2026-09-18 |
| elastic |
ICMP Redirect Message from Internal Host |
production |
2026-09-18 |
| elastic |
Deprecated TLS Version or Weak Cipher Negotiated Externally |
production |
2026-09-18 |
| elastic |
Potential ADIDNS Poisoning via Wildcard Record Creation |
production |
2026-09-18 |
| splunk |
Detect Rogue DHCP Server |
experimental |
2026-05-13 |
| splunk |
Cisco ASA - Packet Capture Activity |
production |
2026-05-13 |
| sigma |
Azure Sign-In With Axios User Agent |
experimental |
2026-04-28 |
| sigma |
Notepad++ Updater DNS Query to Uncommon Domains |
experimental |
2026-03-16 |
| sigma |
Uncommon File Created by Notepad++ Updater Gup.EXE |
experimental |
2026-03-16 |
| sigma |
Suspicious Child Process of Notepad++ Updater - GUP.Exe |
experimental |
2026-02-03 |
| sigma |
ISATAP Router Address Was Set |
experimental |
2025-10-19 |
| sigma |
Huawei BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Cisco BGP Authentication Failures |
test |
2023-01-23 |
| sigma |
Juniper BGP Missing MD5 |
test |
2023-01-23 |
| sigma |
Cisco LDP Authentication Failures |
test |
2023-01-09 |
| sigma |
Potential Suspicious Activity Using SeCEdit |
test |
2022-12-30 |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |