| elastic |
Entra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Entra ID MFA Disabled for User |
production |
2026-09-18 |
| elastic |
Entra ID Guest Account Promoted to Member |
production |
2026-09-18 |
| elastic |
Entra ID Global Administrator Role Assigned |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access Policy (CAP) Modified |
production |
2026-09-18 |
| elastic |
Azure VM Extension Deployment by User |
production |
2026-09-18 |
| elastic |
Azure Automation Webhook Created |
production |
2026-09-18 |
| elastic |
Azure Automation Account Created |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Unusual Country for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Unusual City for an Azure Activity Logs Event |
production |
2026-09-18 |
| elastic |
Rare Azure Activity Logs Event Failures |
production |
2026-09-18 |
| elastic |
Spike in Azure Activity Logs Failed Messages |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Azure AKS API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID User Reported Suspicious Activity |
production |
2026-09-18 |
| elastic |
Entra ID OAuth ROPC Grant Login Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-In via Unusual Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal with Unusual Source ASN |
production |
2026-09-18 |
| elastic |
Entra ID High Risk User Sign-in Heuristic |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection Admin Confirmed Compromise |
production |
2026-09-18 |
| elastic |
Entra ID Protection Alerts for User Detected |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |