| elastic |
Microsoft Foundry Content Filter Modified or Deleted |
production |
2026-10-23 |
| elastic |
Linux Firewall Rule Creation or Modification |
production |
2026-10-23 |
| elastic |
Potential Destructive AWS CLI Command Executed by GenAI Agent |
production |
2026-10-23 |
| elastic |
OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics |
production |
2026-10-23 |
| elastic |
AWS EKS Admission Webhook Created or Modified |
production |
2026-10-21 |
| elastic |
Sensitive Audit Policy Sub-Category Disabled |
production |
2026-10-19 |
| elastic |
OpenAI ChatGPT Enterprise Workspace Feature Toggled |
production |
2026-10-16 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-10-09 |
| elastic |
Kernel Module Removal |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Repeated Assistant Refusals |
production |
2026-10-09 |
| elastic |
Suspicious Kernel Feature Activity |
production |
2026-10-09 |
| elastic |
Microsoft Windows Defender Tampering |
production |
2026-10-07 |
| elastic |
OpenAI ChatGPT Enterprise Codex Security Scan Configuration Changed |
production |
2026-10-06 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-10-06 |
| elastic |
Google Workspace Bitlocker Setting Disabled |
production |
2026-10-06 |
| elastic |
Microsoft Foundry Jailbreak Detected |
production |
2026-10-05 |
| elastic |
Microsoft Foundry Repeated Assistant Refusals |
production |
2026-10-05 |
| elastic |
GCP Vertex AI Publisher Model Config Modified |
production |
2026-10-02 |
| elastic |
GCP Vertex AI Safety Filters Set to BLOCK_NONE |
production |
2026-10-02 |
| elastic |
GCP Vertex AI Jailbreak Prompt Heuristics |
production |
2026-10-02 |
| elastic |
ESXi ExecInstalledOnly Protection Disabled |
production |
2026-09-30 |
| elastic |
ESXi Syslog Remote Host Reset |
production |
2026-09-30 |
| elastic |
ESXi Firewall Disabled |
production |
2026-09-30 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
ESXi Lockdown Mode Disabled |
production |
2026-09-30 |
| elastic |
ESXi Audit Records Disabled |
production |
2026-09-30 |
| elastic |
AWS Bedrock Automated Reasoning Safety Policy Tampering |
production |
2026-09-25 |
| elastic |
AWS Bedrock Model Invocation Logging Disabled or Modified |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action |
production |
2026-09-25 |
| elastic |
Anthropic Organization IP Restriction Deleted |
production |
2026-09-25 |
| elastic |
Anthropic Compliance API Logging Disabled |
production |
2026-09-25 |
| elastic |
GenAI CLI Started with Unsafe Permission Bypass |
production |
2026-09-25 |
| elastic |
AWS Bedrock Guardrail Deleted or Weakened |
production |
2026-09-25 |
| elastic |
Insecure AWS EC2 VPC Security Group Ingress Rule Added |
production |
2026-09-18 |
| elastic |
AWS WAF Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS WAF Rule or Rule Group Deletion |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
AWS Backup Vault Deleted or Vault Lock Removed |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Updated |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Creation |
production |
2026-09-18 |
| elastic |
AWS EC2 Security Group Configuration Change |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
AWS KMS Key Policy Updated via PutKeyPolicy |
production |
2026-09-18 |
| elastic |
Azure Event Hub Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Deleted |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Front Door WAF Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Network Watcher Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Alert Suppression Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Creation |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Deletion |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Modification |
production |
2026-09-18 |
| elastic |
GCP Logging Bucket Deletion |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Deletion |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Subscription Deletion |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Deletion |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Network Deletion |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Creation |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Deletion |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Modification |
production |
2026-09-18 |
| elastic |
GKE Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
GitHub Protected Branch Settings Changed |
production |
2026-09-18 |
| elastic |
GitHub Secret Scanning Disabled |
production |
2026-09-18 |
| elastic |
GitHub App Deleted |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Domain Added to Google Workspace Trusted Domains |
production |
2026-09-18 |
| elastic |
Google Workspace Restrictions for Marketplace Modified to Allow Any App |
production |
2026-09-18 |
| elastic |
Kubernetes Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Rule Modification |
production |
2026-09-18 |
| elastic |
M365 Exchange DKIM Signing Configuration Disabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Exchange DLP Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Link Policy Disabled |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Audit Logging Bypass Added |
production |
2026-09-18 |
| elastic |
M365 Exchange Malware Filter Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Malware Filter Rule Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Attachment Rule Disabled |
production |
2026-09-18 |
| elastic |
M365 SharePoint Site Sharing Policy Weakened |
production |
2026-09-18 |
| elastic |
M365 Teams Custom Application Interaction Enabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Teams External Access Enabled |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Modified |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Deactivate an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Delete an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy |
production |
2026-09-18 |
| elastic |
Attempt to Modify an Okta Policy Rule |
production |
2026-09-18 |
| elastic |
Suspicious Write Attempt to AppArmor Policy Management Files |
production |
2026-09-18 |
| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |
| elastic |
Potential Disabling of AppArmor |
production |
2026-09-18 |
| elastic |
Potential Disabling of SELinux |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
SELinux Configuration Creation or Renaming |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |
| elastic |
Quarantine Attrib Removed by Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Modification of Safari Settings via Defaults Command |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
Decline in host-based traffic |
production |
2026-09-18 |
| elastic |
FortiGate Overly Permissive Firewall Policy Created |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| elastic |
Suspicious Antimalware Scan Interface DLL |
production |
2026-09-18 |
| elastic |
Potential Antimalware Scan Interface Bypass via PowerShell |
production |
2026-09-18 |
| elastic |
Potential AMSI Bypass via RPC Runtime Hooking |
production |
2026-09-18 |
| elastic |
Modification of AmsiEnable Registry Key |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Clearing Windows Event Logs |
production |
2026-09-18 |
| elastic |
Windows Defender Disabled via Registry Modification |
production |
2026-09-18 |
| elastic |
Windows Defender Exclusions Added via PowerShell |
production |
2026-09-18 |
| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
PowerShell Script Block Logging Disabled |
production |
2026-09-18 |
| elastic |
Disable Windows Firewall Rules via Netsh |
production |
2026-09-18 |
| elastic |
Disabling Windows Defender Security Settings via PowerShell |
production |
2026-09-18 |
| elastic |
Disable Windows Event and Security Logs Using Built-in Tools |
production |
2026-09-18 |
| elastic |
DNS-over-HTTPS Enabled via Registry |
production |
2026-09-18 |
| elastic |
Potential EDR-Freeze via WerFaultSecure Abuse |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
Enable Host Network Discovery via Netsh |
production |
2026-09-18 |
| elastic |
IIS HTTP Logging Disabled |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
Potential NetNTLMv1 Downgrade Attack |
production |
2026-09-18 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
PowerShell Script with Windows Defender Tampering Capabilities |
production |
2026-09-18 |
| elastic |
Windows Firewall Disabled via PowerShell |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Potential Evasion via Filter Manager |
production |
2026-09-18 |
| elastic |
WDAC Policy File by an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Evasion via Windows Filtering Platform |
production |
2026-09-18 |
| elastic |
High Number of Process and/or Service Terminations |
production |
2026-09-18 |
| elastic |
Disabling User Account Control via Registry Modification |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via TCCDB Modification |
production |
2026-09-18 |
| elastic |
Elastic Agent Service Terminated |
production |
2026-09-18 |
| elastic |
First Seen Network Flow Exporter Followed by Suspicious Source Activity |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Potential HTTP Downgrade Attack |
production |
2026-09-18 |
| elastic |
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Created |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Deleted |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Evasion |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Suspended |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Management Events Disabled via PutEventSelectors |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Alarm Deletion |
production |
2026-09-18 |
| elastic |
AWS Config Resource Deletion |
production |
2026-09-18 |
| elastic |
AWS Configuration Recorder Stopped |
production |
2026-09-18 |
| elastic |
AWS Detective Graph Deleted |
production |
2026-09-18 |
| elastic |
AWS VPC Flow Logs Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 NACL Entry Created or Replaced Allowing All Traffic by New Identity |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Deletion |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
AWS EKS Control Plane Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detector Deletion |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detection Suppression |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Threat Intelligence Set Deleted |
production |
2026-09-18 |
| elastic |
AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity |
production |
2026-09-18 |
| elastic |
AWS Attempt to Leave Organization |
production |
2026-09-18 |
| elastic |
AWS Route 53 Resolver Query Log Configuration Deleted |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Configuration Deletion |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Expiration Lifecycle Configuration Added |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Server Access Logging Disabled |
production |
2026-09-18 |
| elastic |
AWS Security Hub Disabled |
production |
2026-09-18 |
| elastic |
AWS SQS Queue Purge |
production |
2026-09-18 |
| elastic |
AWS Audit or Security Service Tampering via CLI |
production |
2026-09-14 |
| splunk |
Cisco IOS XE VTY Access Class Tampering |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal |
production |
2026-05-20 |
| elastic |
Deprecated - AWS ElastiCache Security Group Created |
deprecated |
2026-01-16 |
| elastic |
Deprecated - AWS ElastiCache Security Group Modified or Deleted |
deprecated |
2026-01-16 |
| elastic |
Attempt to Disable IPTables or Firewall |
deprecated |
2022-07-25 |
| sentinel |
Security Service Registry ACL Modification |
Scheduled |
— |