| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| elastic |
Entra ID End-User Consent to Application with High-Risk Delegated Scopes |
production |
2026-10-02 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Google Workspace Object Copied from External Drive with App Consent |
production |
2026-09-24 |
| splunk |
Windows Defender ASR Rules Stacking |
production |
2026-09-22 |
| splunk |
Windows Defender ASR Block Events |
production |
2026-09-22 |
| splunk |
Windows Defender ASR Audit Events |
production |
2026-09-22 |
| elastic |
Okta FastPass Phishing Detection |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Downloaded Shortcut Files |
production |
2026-09-18 |
| elastic |
Downloaded URL Files |
production |
2026-09-18 |
| elastic |
Unusual Execution via Microsoft Common Console File |
production |
2026-09-18 |
| elastic |
Execution of File Written or Modified by Microsoft Office |
production |
2026-09-18 |
| elastic |
Suspicious HTML File Creation |
production |
2026-09-18 |
| elastic |
Potential Remote File Execution via MSIEXEC |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-33053 Exploitation |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Flow with Concurrent Sign-ins |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID Illicit Consent Grant via Registered Application |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration After OAuth from Suspicious ASN |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by User Sign-in to Device Registration |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Illicit Consent Grant by Rare Client and User |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device) |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance Email Reported by User as Malware or Phish |
deprecated |
2026-08-13 |
| splunk |
O365 Threat Intelligence Suspicious Email Delivered |
production |
2026-05-13 |
| splunk |
O365 ZAP Activity Detection |
production |
2026-05-13 |
| splunk |
Process Creating LNK file in Suspicious Location |
production |
2026-05-13 |
| splunk |
O365 Email Reported By Admin Found Malicious |
production |
2026-05-13 |
| splunk |
Azure AD Device Code Authentication |
production |
2026-05-13 |
| splunk |
O365 Email Reported By User Found Malicious |
production |
2026-05-13 |
| sigma |
EvilTokens PhaaS Kit Phishing Related Request - Proxy |
experimental |
2026-04-28 |
| elastic |
Deprecated - Execution of File Written or Modified by PDF Reader |
deprecated |
2026-02-04 |
| sigma |
Suspicious Email Delivered In Microsoft 365 |
experimental |
2026-01-27 |
| sigma |
Potential Malicious Usage of CloudTrail System Manager |
test |
2025-12-08 |
| sigma |
Suspicious Execution via macOS Script Editor |
test |
2022-12-28 |