| elastic |
Curl SOCKS Proxy Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity with High Confidence |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity |
production |
2026-09-18 |
| elastic |
Entra ID Custom Domain Added or Verified |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Rolebindings Created |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Entra ID Elevated Access to User Access Administrator |
production |
2026-09-18 |
| elastic |
Entra ID Protection User Alert and Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID External Authentication Methods (EAM) Modified |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
Entra ID Deviceless Windows Hello Sign-in Followed by Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello for Business Credential Registered |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Non-Managed Device |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Registered Application Owner |
production |
2026-09-18 |
| elastic |
Entra ID Unusual Cloud Device Registration |
production |
2026-09-18 |
| elastic |
Entra ID ADRS Token Request by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID Federated Identity Credential Issuer Modified |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Credentials Created by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Created |
production |
2026-09-18 |
| elastic |
Entra ID OAuth PRT Issuance to Non-Managed Device Detected |
production |
2026-09-18 |
| elastic |
Entra ID Device Registration with ROADtools Default OS Build |
production |
2026-09-18 |
| elastic |
Entra ID Register Device with Unusual User Agent (Azure AD Join) |
production |
2026-09-18 |
| elastic |
Entra ID Privileged Identity Management (PIM) Role Modified |
production |
2026-09-18 |
| elastic |
Entra ID Global Administrator Role Assigned (PIM User) |
production |
2026-09-18 |
| elastic |
Entra ID Device Registration with Phishing Kit Default OS Build |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Application Redirect URI Modified |
production |
2026-09-18 |
| elastic |
Entra ID Multiple Device Registrations by a Single User |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Entra ID MFA Disabled for User |
production |
2026-09-18 |
| elastic |
Entra ID Guest Account Promoted to Member |
production |
2026-09-18 |
| elastic |
Entra ID Global Administrator Role Assigned |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access Policy (CAP) Modified |
production |
2026-09-18 |
| elastic |
Azure VM Extension Deployment by User |
production |
2026-09-18 |
| elastic |
Azure Automation Webhook Created |
production |
2026-09-18 |
| elastic |
Azure Automation Account Created |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Unusual Country for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual City for an Azure Activity Logs Event |
production |
2026-09-18 |