| elastic |
AWS Management Console Brute Force of Root User Identity |
production |
2026-09-18 |
| elastic |
AWS Root Console Login Password Spraying |
production |
2026-09-18 |
| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Sign-in to Azure AD Graph Enumeration |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Deleted |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Evasion |
production |
2026-09-18 |
| elastic |
Azure VM Boot Diagnostics Retrieved |
production |
2026-09-18 |
| elastic |
Azure Storage Account Keys Accessed by Privileged User |
production |
2026-09-18 |
| elastic |
Azure Service Principal Sign-In Followed by Arc Cluster Credential Access |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Flow with Concurrent Sign-ins |
production |
2026-09-18 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
Azure AKS Service Account Token Created via TokenRequest API |
production |
2026-09-18 |
| elastic |
Azure AKS Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: Unauthorized Method |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: sqlmap User Agent |
production |
2026-09-18 |
| elastic |
Multiple DHCP Servers Responding to the Same Transaction |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
Potential Network Scan Detected |
production |
2026-09-18 |
| elastic |
Default Cobalt Strike Team Server Certificate |
production |
2026-09-18 |
| elastic |
Potential SIP Extension Enumeration |
production |
2026-09-18 |
| elastic |
FortiGate Overly Permissive Firewall Policy Created |
production |
2026-09-18 |
| elastic |
Potential SYN-Based Port Scan Detected |
production |
2026-09-18 |
| elastic |
Cassandra JavaScript UDF Creation |
production |
2026-09-18 |
| elastic |
Cloud Instance Metadata Credential Path HTTP Request |
production |
2026-09-18 |
| elastic |
PostgreSQL COPY PROGRAM Command Execution |
production |
2026-09-18 |
| elastic |
Roshal Archive (RAR) or PowerShell File Downloaded from the Internet |
production |
2026-09-18 |
| elastic |
Successful AMQP Multi-Queue Purge Burst |
production |
2026-09-18 |
| elastic |
First-Time Destructive MongoDB Command from a Client IP |
production |
2026-09-18 |
| elastic |
Potential DHCP Starvation via High Client MAC Cardinality |
production |
2026-09-18 |
| elastic |
ICMP Timestamp or Information Request from the Internet |
production |
2026-09-18 |
| elastic |
ICMP Redirect Message from Internal Host |
production |
2026-09-18 |
| elastic |
Potential ICMP Tunneling Activity to the Internet |
production |
2026-09-18 |
| elastic |
Potential SIP REGISTER Brute Force |
production |
2026-09-18 |
| elastic |
Possible FIN7 DGA Command and Control Behavior |
production |
2026-09-18 |
| elastic |
RDP (Remote Desktop Protocol) from the Internet |
production |
2026-09-18 |
| elastic |
Cobalt Strike Command and Control Beacon |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Potential Self-Signed TLS Certificate Recently Issued on External Connection |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) to the Internet |
production |
2026-09-18 |
| elastic |
SMTP to the Internet on Port 26/TCP |
production |
2026-09-18 |