| elastic |
Newly Observed Elastic Defend Behavior Alert |
production |
2026-09-28 |
| elastic |
First-Time FortiGate Administrator Login |
production |
2026-09-28 |
| elastic |
Newly Observed High Severity Detection Alert |
production |
2026-09-28 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-09-28 |
| elastic |
Unusual Azure VM Extension Detected |
production |
2026-09-28 |
| elastic |
FortiGate FortiCloud SSO Login from Unusual Source |
production |
2026-09-28 |
| elastic |
Potential NetScaler Log Poisoning Command Injection Attempt |
production |
2026-09-28 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-09-28 |
| elastic |
Potential TerminalFix Cloudflare Lure in PowerShell |
production |
2026-09-28 |
| elastic |
Microsoft Defender XDR Incident External Alerts |
production |
2026-09-28 |
| elastic |
AWS Lambda Function Invoked by an Unusual Principal |
production |
2026-09-28 |
| elastic |
AWS Lambda Function Deletion by Unusual User |
production |
2026-09-28 |
| elastic |
AWS Backup Recovery Point Deleted by Unusual User |
production |
2026-09-28 |
| sigma |
Uncommon Child Process Spawned From XBootMgrSleep.EXE |
experimental |
2026-09-27 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| sigma |
Azure Subscription Permission Elevation Via AuditLogs |
test |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ambientcoffee .com domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.robertschulze .net domain |
rev 1 |
2026-09-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bizuit .com domain |
rev 1 |
2026-09-26 |
| elastic |
Ollama API Accessed from External Network |
production |
2026-09-25 |
| elastic |
Elastic Defend Alert from GenAI Utility or Descendant |
production |
2026-09-25 |
| elastic |
Anthropic Excessive Chat Access Failures |
production |
2026-09-25 |
| elastic |
AWS IAM Credentials Added to a Bedrock API Key Phantom User |
production |
2026-09-25 |
| elastic |
Anthropic Organization Data Export Accessed |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Phantom User Activity Outside Bedrock |
production |
2026-09-25 |
| elastic |
Azure OpenAI Insecure Output Handling |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
Claude Cowork VM Boot Image Tamper |
production |
2026-09-25 |
| elastic |
Potential Azure OpenAI Model Theft |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata |
production |
2026-09-25 |