| elastic |
Unusual Host Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Spike in Group Application Assignment Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Lifecycle Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Membership Events |
production |
2026-09-18 |
| elastic |
Spike in Group Privilege Change Events |
production |
2026-09-18 |
| elastic |
Spike in User Lifecycle Management Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Management Events |
production |
2026-09-18 |
| elastic |
Spike in Special Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Unusual Privilege Type assigned to a User |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a Host |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via PRoot |
production |
2026-09-18 |
| elastic |
Potential Process Name Stomping with Prctl |
production |
2026-09-18 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| elastic |
Root Certificate Installation |
production |
2026-09-18 |
| elastic |
SELinux Configuration Creation or Renaming |
production |
2026-09-18 |
| elastic |
Shell History Clearing via Environment Variables |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
Potentially Suspicious Process Started via tmux or screen |
production |
2026-09-18 |
| elastic |
Suspicious Path Mounted |
production |
2026-09-18 |
| elastic |
System Binary Symlink to Suspicious Location |
production |
2026-09-18 |
| elastic |
Suspicious Kernel Feature Activity |
production |
2026-09-18 |
| elastic |
Unusual Kill Signal |
production |
2026-09-18 |
| elastic |
Unusual Preload Environment Variable Process Execution |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Linux External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
System Information Discovery via dmidecode from Parent Shell |
production |
2026-09-18 |
| elastic |
Docker Socket Enumeration |
production |
2026-09-18 |
| elastic |
Suspicious Dynamic Linker Discovery via od |
production |
2026-09-18 |
| elastic |
ESXI Discovery via Find |
production |
2026-09-18 |
| elastic |
ESXI Discovery via Grep |
production |
2026-09-18 |
| elastic |
Kernel Instrumentation Discovery via kprobes and tracefs |
production |
2026-09-18 |