| elastic |
Kubernetes Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy |
production |
2026-09-18 |
| elastic |
Google Workspace User Organizational Unit Changed |
production |
2026-09-18 |
| elastic |
Google Workspace Role Modified |
production |
2026-09-18 |
| elastic |
Google Workspace Password Policy Modified |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration Burst for Single User |
production |
2026-09-18 |
| elastic |
Google Workspace User Sign-in from Atypical Device Type |
production |
2026-09-18 |
| elastic |
Google Workspace Device Registration After OAuth from Suspicious ASN |
production |
2026-09-18 |
| elastic |
Google Workspace Custom Admin Role Created |
production |
2026-09-18 |
| elastic |
Google Workspace API Access Granted via Domain-Wide Delegation |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Assigned to a User or Group |
production |
2026-09-18 |
| elastic |
Google Workspace 2SV Policy Disabled By User |
production |
2026-09-18 |
| elastic |
GKE Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
GKE Ephemeral Container Added to Pod |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request for Privileged Identity |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request API Client Signer Requested |
production |
2026-09-18 |
| elastic |
GKE API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
GKE API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Impersonation Role Granted |
production |
2026-09-18 |
| elastic |
GCP Service Account Creation |
production |
2026-09-18 |
| elastic |
GCP Service Account Key Creation |
production |
2026-09-18 |
| elastic |
GCP IAM Service Account Key Deletion |
production |
2026-09-18 |
| elastic |
GKE Creation or Modification of Sensitive Role |
production |
2026-09-18 |
| elastic |
GKE Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
GKE Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
GKE Cluster-Admin Role Binding Created or Modified |
production |
2026-09-18 |
| elastic |
GKE Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
GKE Certificate Signing Request Self-Approved |
production |
2026-09-18 |
| elastic |
Creation of Hidden Login Item via Apple Script |
production |
2026-09-18 |
| elastic |
GKE Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Rare GCP Audit Failure Event Code |
production |
2026-09-18 |
| elastic |
Spike in GCP Audit Failed Messages |
production |
2026-09-18 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |