| elastic |
Multiple Logon Failure Followed by Logon Success |
production |
2026-09-18 |
| elastic |
Multiple Logon Failure from the same Source Address |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Windows Utilities |
production |
2026-09-18 |
| elastic |
NTDS or SAM Database File Copied |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
First Time Seen Account Performing DCSync |
production |
2026-09-18 |
| elastic |
Potential Credential Access via DCSync |
production |
2026-09-18 |
| elastic |
Potential Active Directory Replication Account Backdoor |
production |
2026-09-18 |
| elastic |
Kerberos Pre-authentication Disabled for User |
production |
2026-09-18 |
| elastic |
Creation of a DNS-Named Record |
production |
2026-09-18 |
| elastic |
Potential Computer Account NTLM Relay Activity |
production |
2026-09-18 |
| elastic |
Potential Kerberos Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Potential NTLM Relay Attack against a Computer Account |
production |
2026-09-18 |
| elastic |
Creation or Modification of Domain Backup DPAPI private key |
production |
2026-09-18 |
| elastic |
Credential Acquisition via Registry Hive Dumping |
production |
2026-09-18 |
| elastic |
Potential Entra ID PRT Extraction via BrowserCore |
production |
2026-09-18 |
| elastic |
Full User-Mode Dumps Enabled System-Wide |
production |
2026-09-18 |
| elastic |
Microsoft IIS Service Account Password Dumped |
production |
2026-09-18 |
| elastic |
Microsoft IIS Connection Strings Decryption |
production |
2026-09-18 |
| elastic |
Untrusted DLL Loaded by Azure AD Connect Authentication Agent |
production |
2026-09-18 |
| elastic |
Kerberos Traffic from Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Kerberos Coercion via DNS-Based SPN Spoofing |
production |
2026-09-18 |
| elastic |
Potential Kerberos SPN Spoofing via Suspicious DNS Query |
production |
2026-09-18 |
| elastic |
Newly Observed RC4 Kerberos Service Ticket Request |
production |
2026-09-18 |
| elastic |
Kirbi File Creation |
production |
2026-09-18 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-09-18 |
| elastic |
Suspicious LSASS Access via MalSecLogon |
production |
2026-09-18 |
| elastic |
Suspicious Module Loaded by LSASS |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Creation |
production |
2026-09-18 |
| elastic |
LSASS Memory Dump Handle Access |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Mimikatz Memssp Log File Detected |
production |
2026-09-18 |
| elastic |
Potential Invoke-Mimikatz PowerShell Script |
production |
2026-09-18 |
| elastic |
Modification of WDigest Security Provider |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Network Logon Provider Registry Modification |
production |
2026-09-18 |
| elastic |
PKINIT Followed by Same-Principal U2U Service Ticket |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
PowerShell MiniDump Script |
production |
2026-09-18 |