| elastic |
Azure Diagnostic Settings Alert Suppression Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Azure VNet Network Watcher Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Front Door WAF Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Policy Deleted |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Deleted |
production |
2026-09-18 |
| elastic |
Azure Event Hub Deleted |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello or Passkey Sign-in from Unregistered Device |
production |
2026-09-18 |
| elastic |
Entra ID Conditional Access MFA Bypass with Unusual User, Client and Source ASN |
production |
2026-09-18 |
| elastic |
Azure AKS Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Azure Automation Runbook Deleted |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
Azure VNet Full Network Packet Capture Enabled |
production |
2026-09-18 |
| elastic |
Azure Key Vault Unusual Secret Key Usage |
production |
2026-09-18 |
| elastic |
Azure Key Vault Excessive Secret or Key Retrieved |
production |
2026-09-18 |
| elastic |
Entra ID MFA TOTP Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Concurrent Sign-in with Suspicious Properties |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in Brute Force Attempted (Microsoft 365) |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
Entra ID Device-Bound PRT from Unusual Device IP |
production |
2026-09-18 |
| elastic |
Entra ID Excessive Account Lockouts Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Unexpected Child Process of macOS Screensaver Engine |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Multiple Cloud Secrets Accessed by Source Address |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| elastic |
Credential Access via TruffleHog Execution |
production |
2026-09-18 |
| elastic |
Web Server Cloud Metadata SSRF Request |
production |
2026-09-18 |
| elastic |
Agent Spoofing - Multiple Hosts Using Same Agent |
production |
2026-09-18 |
| elastic |
Data Encrypted via OpenSSL Utility |
production |
2026-09-18 |
| elastic |
WebServer Access Logs Deleted |
production |
2026-09-18 |
| elastic |
Tampering of Shell Command-Line History |
production |
2026-09-18 |
| elastic |
Elastic Agent Service Terminated |
production |
2026-09-18 |
| elastic |
ROT Encoded Python Script Execution |
production |
2026-09-18 |
| elastic |
First Seen Network Flow Exporter Followed by Suspicious Source Activity |
production |
2026-09-18 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Potential HTTP Downgrade Attack |
production |
2026-09-18 |