| elastic |
Azure Key Vault Modified |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Pods Deleted |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
Azure AD Graph Access with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Azure Arc Cluster Credential Access by Identity from Unusual Source |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Microsoft Authentication Broker |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Entra ID OAuth User Impersonation to Microsoft Graph |
production |
2026-09-18 |
| elastic |
Entra ID High Risk Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Illicit Consent Grant via Registered Application |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent |
production |
2026-09-18 |
| elastic |
Entra ID Microsoft Authentication Broker Sign-In to Unusual Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Phishing via AiTM |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
Entra ID OAuth user_impersonation Scope for Unusual User and Client |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID Protection Alerts for User Detected |
production |
2026-09-18 |
| elastic |
Entra ID Protection Admin Confirmed Compromise |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - Sign-in Risk |
production |
2026-09-18 |
| elastic |
Entra ID Protection - Risk Detection - User Risk |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in with Unusual Authentication Type |
production |
2026-09-18 |
| elastic |
Entra ID High Risk User Sign-in Heuristic |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal with Unusual Source ASN |
production |
2026-09-18 |
| elastic |
Microsoft Entra ID Impossible Travel Sign-in |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) |
production |
2026-09-18 |
| elastic |
Entra ID Temporary Access Pass Created for User |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-In via Unusual Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
Entra ID OAuth ROPC Grant Login Detected |
production |
2026-09-18 |
| elastic |
Entra ID User Reported Suspicious Activity |
production |
2026-09-18 |
| elastic |
Microsoft Graph Request User Impersonation by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID Potential AiTM Sign-In via OfficeHome (Tycoon2FA) |
production |
2026-09-18 |
| elastic |
Azure AKS API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Spike in Azure Activity Logs Failed Messages |
production |
2026-09-18 |