| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Kubernetes Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created With HostPID |
production |
2026-09-18 |
| elastic |
Kubernetes Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |
| elastic |
Kubernetes Privileged Pod Created |
production |
2026-09-18 |
| elastic |
Kubernetes RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive RBAC Change Followed by Workload Modification |
production |
2026-09-18 |
| elastic |
Unusual Kubernetes Sensitive Workload Modification |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Modified RBAC Objects |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Assignment of Controller Service Account |
production |
2026-09-18 |
| elastic |
High Mean of Process Arguments in an RDP Session |
production |
2026-09-18 |
| elastic |
High Mean of RDP Session Duration |
production |
2026-09-18 |
| elastic |
Unusual Remote File Size |
production |
2026-09-18 |
| elastic |
High Variance in RDP Session Duration |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
Unusual Remote File Extension |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made from a Source IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made to a Destination IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Processes in an RDP Session |
production |
2026-09-18 |
| elastic |
Spike in Remote File Transfers |
production |
2026-09-18 |
| elastic |
Unusual Time or Day for an RDP Session |
production |
2026-09-18 |
| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack via macOS Security Events |
production |
2026-09-18 |
| elastic |
M365 Azure Monitor Alert Email with Financial or Billing Theme |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Items Accessed Excessively |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Forwarding Rule Created |
production |
2026-09-18 |
| elastic |
M365 OneDrive/SharePoint Excessive File Downloads |
production |
2026-09-18 |
| elastic |
M365 SharePoint/OneDrive File Access via PowerShell |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by User Sign-in to Device Registration |
production |
2026-09-18 |
| elastic |
M365 Identity User Brute Force Attempted |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Rule Modification |
production |
2026-09-18 |
| elastic |
M365 Exchange DKIM Signing Configuration Disabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Exchange DLP Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Link Policy Disabled |
production |
2026-09-18 |