| elastic |
AWS SSM Session Manager Child Process Execution |
production |
2026-10-21 |
| elastic |
Unusual Azure VM Extension Detected |
production |
2026-09-28 |
| elastic |
Azure Run Command Script Child Process |
production |
2026-09-18 |
| elastic |
Azure Run Command Correlated with Process Execution |
production |
2026-09-18 |
| elastic |
First Time AWS CloudFormation Stack Creation |
production |
2026-09-18 |
| elastic |
AWS SSM Command Document Created by Rare User |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` Execution by Rare User |
production |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
Azure VM Managed Run Command Created or Updated with Unusual Principal |
production |
2026-09-18 |
| elastic |
Azure Compute VM Command Executed |
production |
2026-09-18 |
| elastic |
Azure VM Extension Deployment by User |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Creation |
production |
2026-09-18 |
| elastic |
Suspicious Child Process via Azure VM CustomScript Extension |
production |
2026-09-18 |
| elastic |
Azure VM Extension CRUD Operation with Unusual Source ASN |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` with Run Shell Command Parameters |
production |
2026-09-18 |