Windows Event Collector

Cortex XDR Analytics Alert Reference by data source

Last date published: 2024-04-15
Order: data source

Cortex XDR Analytics Alert Reference
Required Data Sources
AWS Audit Log
Cloud user performed multiple actions that were denied
Storage enumeration activity
Multiple cloud snapshots export
Suspicious identity downloaded multiple objects from a bucket
Allocation of multiple cloud compute resources
Suspicious objects encryption in an AWS bucket
IAM Enumeration sequence
Multiple failed logins from a single IP
Deletion of multiple cloud resources
Allocation of compute resources in multiple regions
Kubernetes enumeration activity
An identity performed a suspicious download of multiple cloud storage objects
Cloud infrastructure enumeration activity
An identity dumped multiple secrets from a project
Multi region enumeration activity
Impossible travel by a cloud identity
Kubernetes Privileged Pod Creation
An AWS SAML provider was modified
A Kubernetes Pod was deleted
An AWS Lambda function was modified
Unusual cloud identity impersonation
An operation was performed by an identity from a domain that was not seen in the organization
MFA device was removed/deactivated from an IAM user
An Email address was added to AWS SES
Suspicious cloud compute instance ssh keys modification attempt
An AWS EFS file-share was deleted
Cloud Watch alarm deletion
Kubernetes Pod created with host process ID (PID) namespace
AWS config resource deletion
Cloud Trail Logging has been stopped/suspended
An AWS GuardDuty IP set was created
A Kubernetes service account has enumerated its permissions
A cloud snapshot was created or modified
A Kubernetes namespace was created or deleted
An IAM group was created
A Kubernetes cluster was created or deleted
A Kubernetes node service account activity from external IP
IAM User added to an IAM group
A Kubernetes DaemonSet was created
A Kubernetes ConfigMap was created or deleted
A cloud function was created with an unusual runtime
Remote usage of AWS Lambda's token
Kubernetes network policy modification
Cloud Trail logging deletion
AWS SSM send command attempt
Unusual AWS systems manager activity
An AWS RDS Global Cluster Deletion
AWS EC2 instance exported into S3
S3 configuration deletion
AWS CloudWatch log stream deletion
An AWS Lambda Function was created
A cloud storage configuration was modified
Unusual resource modification by newly seen IAM user
AWS SecurityHub findings were modified
A Kubernetes deployment was created
A Kubernetes Cronjob was created
An AWS EKS cluster was created or deleted
A Kubernetes ReplicaSet was created
An AWS SES identity was deleted
Unusual IAM enumeration activity by a non-user Identity
AWS network ACL rule deletion
An identity created or updated password for an IAM user
A Kubernetes service was created or deleted
AWS Flow Logs deletion
Penetration testing tool attempt
A cloud identity executed an API call from an unusual country
Remote usage of an AWS service token
Disable encryption operations
An AWS EFS File-share mount was deleted
A Kubernetes secret was created or deleted
AWS Cloud Trail log trail modification
Suspicious usage of EC2 token
A cloud identity created or modified a security group
An AWS ElastiCache security group was created
Unusual key management activity
A Kubernetes cluster role binding was created or deleted
AWS RDS cluster deletion
Network sniffing detected in Cloud environment
An identity disabled bucket logging
AWS user creation
Cloud unusual access key creation
A Kubernetes API operation was successfully invoked by an anonymous user
AWS Role Trusted Entity modification
Suspicious API call from a Tor exit node
An identity attached an administrative policy to an IAM user/role
A cloud identity invoked IAM related persistence operations
An AWS ElastiCache security group was modified or deleted
AWS STS temporary credentials were generated
Cloud identity reached a throttling API rate
Cloud compute serial console access
A cloud identity had escalated its permissions
Log4J exploitation attempt against cloud hosted resources
Kubernetes cluster events deletion
A Kubernetes ephemeral container was created
Activity in a dormant region of a cloud project
Unusual resource modification/creation
Unusual Identity and Access Management (IAM) activity
Unusual secret management activity
AWS Config Recorder stopped
An AWS RDS instance was created from a snapshot
An identity started an AWS SSM session
A Kubernetes StatefulSet was created
An AWS Route 53 domain was transferred to another AWS account
AWS Root account activity
Unusual certificate management activity
Cloud impersonation attempt by unusual identity type
A Kubernetes dashboard service account was used outside the cluster
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes Pod Created With Sensitive Volume
AWS web ACL deletion
Unusual cross projects activity
Kubernetes pod creation with host network
AWS Guard-Duty detector deletion
A Kubernetes role binding was created or deleted
A container registry was created or deleted
AWS CloudWatch log group deletion
A compute-attached identity executed API calls outside the instance's region
A user logged in to the AWS console for the first time
An AWS S3 bucket configuration was modified
AWS network ACL rule creation
An AWS SES Email sending settings were modified
Billing admin role was removed
EC2 snapshot attribute has been modification
Penetration testing tool activity
A Kubernetes service account was created or deleted
Aurora DB cluster stopped
AWS IAM resource group deletion
An AWS RDS master password was changed
AWS Flow Log
An internal Cloud resource performed port scan on external networks
AWS OCSF Flow Logs
An internal Cloud resource performed port scan on external networks
Azure Audit Log
Cloud user performed multiple actions that were denied
Storage enumeration activity
Multiple cloud snapshots export
Suspicious identity downloaded multiple objects from a bucket
Allocation of multiple cloud compute resources
Multiple failed logins from a single IP
Deletion of multiple cloud resources
Allocation of compute resources in multiple regions
Kubernetes enumeration activity
An identity performed a suspicious download of multiple cloud storage objects
An identity dumped multiple secrets from a project
Multi region enumeration activity
Impossible travel by a cloud identity
Azure Storage Account key generated
Kubernetes Privileged Pod Creation
A Kubernetes Pod was deleted
Azure Automation Webhook creation
An Azure VPN Connection was modified
An operation was performed by an identity from a domain that was not seen in the organization
Suspicious cloud compute instance ssh keys modification attempt
An Azure Cloud Shell was Created
Kubernetes Pod created with host process ID (PID) namespace
A Kubernetes service account has enumerated its permissions
A cloud snapshot was created or modified
A Kubernetes namespace was created or deleted
Azure Key Vault modification
A Kubernetes cluster was created or deleted
A Kubernetes node service account activity from external IP
A Kubernetes DaemonSet was created
A Kubernetes ConfigMap was created or deleted
Kubernetes network policy modification
An Azure virtual network was modified
An identity accessed Azure Kubernetes Secrets
Azure Network Watcher Deletion
An Azure Kubernetes Role or Cluster-Role was modified
Azure Event Hub Deletion
A cloud storage configuration was modified
An Azure DNS Zone was modified
Unusual resource modification by newly seen IAM user
A Kubernetes deployment was created
An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted
A Kubernetes Cronjob was created
Removal of an Azure Owner from an Application or Service Principal
A Kubernetes ReplicaSet was created
An identity was granted permissions to manage user access to Azure resources
A Kubernetes service was created or deleted
A cloud identity executed an API call from an unusual country
Azure diagnostic configuration deletion
A Kubernetes secret was created or deleted
An Azure Key Vault was modified
Azure Blob Container Access Level Modification
A cloud identity created or modified a security group
Azure Automation Runbook Creation/Modification
Unusual key management activity
A Kubernetes cluster role binding was created or deleted
An Azure Network Security Group was modified
Network sniffing detected in Cloud environment
An Azure Key Vault key was modified
A Kubernetes API operation was successfully invoked by an anonymous user
Modification or Deletion of an Azure Application Gateway Detected
Suspicious API call from a Tor exit node
A cloud identity invoked IAM related persistence operations
Cloud identity reached a throttling API rate
Azure Automation Account Creation
A Service Principal was removed from Azure
A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
Cloud compute serial console access
A cloud identity had escalated its permissions
Remote usage of an Azure Managed Identity token
Log4J exploitation attempt against cloud hosted resources
Azure Key Vault Secrets were modified
Kubernetes cluster events deletion
An Azure Suppression Rule was created
A Kubernetes ephemeral container was created
An Azure virtual network Device was modified
Azure Event Hub Authorization rule creation/modification
Azure Resource Group Deletion
Activity in a dormant region of a cloud project
Unusual resource modification/creation
Unusual secret management activity
A Kubernetes StatefulSet was created
Unusual certificate management activity
Azure device code authentication flow used
An Azure Firewall Rule Collection was modified
A Kubernetes dashboard service account was used outside the cluster
Azure Automation Runbook Deletion
PIM privilege member removal
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes Pod Created With Sensitive Volume
An Azure firewall rule group was modified
Unusual cross projects activity
Kubernetes pod creation with host network
An Azure Kubernetes Cluster was created or deleted
Azure Kubernetes events were deleted
A Kubernetes role binding was created or deleted
A container registry was created or deleted
An Azure Point-to-Site VPN was modified
An Azure Firewall was modified
Granting Access to an Account
Azure virtual machine commands execution
An Azure Firewall policy deletion
Billing admin role was removed
Penetration testing tool activity
Remote usage of an Azure Service Principal token
An Azure Kubernetes Service Account was modified or deleted
A Kubernetes service account was created or deleted
Azure Flow Log
An internal Cloud resource performed port scan on external networks
AzureAD
SSO Password Spray
Intense SSO failures
Impossible traveler - SSO
SSO Brute Force
A disabled user attempted to authenticate via SSO
SSO with abnormal user agent
SSO with abnormal operating system
Suspicious SSO access from ASN
A user connected from a new country
Suspicious Azure AD interactive sign-in using PowerShell
A successful SSO sign-in from TOR
SSO authentication by a service account
SSO with new operating system
First SSO access from ASN in organization
User attempted to connect from a suspicious country
A user logged in at an unusual time via SSO
First connection from a country in organization
Suspicious authentication with Azure Password Hash Sync user
First SSO access from ASN for user
SSO authentication by a machine account
AzureAD Audit Log
Multiple Azure AD admin role removals
Short-lived Azure AD user account
First Azure AD PowerShell operation for a user
Azure account creation by a non-standard account
BitLocker key retrieval
Azure service principal assigned app role
Conditional Access policy removed
Azure application credentials added
Azure domain federation settings modification attempt
Owner added to Azure application
Identity assigned an Azure AD Administrator Role
Azure application consent
Azure account deletion by a non-standard account
Azure AD PIM role settings change
Unverified domain added to Azure AD
Azure AD PIM alert disabled
MFA was disabled for an Azure identity
Successful unusual guest user invitation
Unusual Conditional Access operation for an identity
Azure AD account unlock/password reset attempt
Authentication method added to an Azure account
Azure application URI modification
Azure Temporary Access Pass (TAP) registered to an account
Device Registration Policy modification
Azure AD PIM elevation request
Box Audit Log
Massive file downloads from SaaS service
External SaaS file-sharing activity
Massive upload to SaaS service
Suspicious SaaS API call from a Tor exit node
DropBox
Massive file downloads from SaaS service
External SaaS file-sharing activity
Massive upload to SaaS service
Suspicious SaaS API call from a Tor exit node
Gcp Audit Log
Cloud user performed multiple actions that were denied
Storage enumeration activity
Multiple cloud snapshots export
Suspicious identity downloaded multiple objects from a bucket
Allocation of multiple cloud compute resources
IAM Enumeration sequence
Multiple failed logins from a single IP
Deletion of multiple cloud resources
Allocation of compute resources in multiple regions
Kubernetes enumeration activity
An identity performed a suspicious download of multiple cloud storage objects
Cloud infrastructure enumeration activity
An identity dumped multiple secrets from a project
Multi region enumeration activity
Impossible travel by a cloud identity
Kubernetes Privileged Pod Creation
A Kubernetes Pod was deleted
Unusual cloud identity impersonation
An operation was performed by an identity from a domain that was not seen in the organization
Suspicious cloud compute instance ssh keys modification attempt
Kubernetes Pod created with host process ID (PID) namespace
GCP VPC Firewall Rule Deletion
A Kubernetes service account has enumerated its permissions
A cloud snapshot was created or modified
A Kubernetes namespace was created or deleted
GCP Storage Bucket Permissions Modification
A Kubernetes cluster was created or deleted
GCP set IAM policy activity
A Kubernetes node service account activity from external IP
A Kubernetes DaemonSet was created
A Kubernetes ConfigMap was created or deleted
A cloud function was created with an unusual runtime
Kubernetes network policy modification
GCP Service Account Disable
GCP Logging Sink Deletion
A cloud storage configuration was modified
Unusual resource modification by newly seen IAM user
GCP Virtual Private Network Route Creation
A Kubernetes deployment was created
GCP IAM Service Account Key Deletion
A Kubernetes Cronjob was created
GCP Logging Sink Modification
A Kubernetes ReplicaSet was created
Unusual IAM enumeration activity by a non-user Identity
A Kubernetes service was created or deleted
Cloud Organizational policy was created or modified
A cloud identity executed an API call from an unusual country
GCP Storage Bucket Configuration Modification
A Kubernetes secret was created or deleted
A cloud identity created or modified a security group
GCP Service Account key creation
Unusual key management activity
A Kubernetes cluster role binding was created or deleted
GCP Firewall Rule creation
Network sniffing detected in Cloud environment
GCP Storage Bucket deletion
Cloud unusual access key creation
A Kubernetes API operation was successfully invoked by an anonymous user
Suspicious API call from a Tor exit node
A cloud identity invoked IAM related persistence operations
GCP Service Account creation
GCP Virtual Private Cloud (VPC) Network Deletion
Cloud identity reached a throttling API rate
Cloud compute serial console access
GCP Firewall Rule Modification
A cloud identity had escalated its permissions
Log4J exploitation attempt against cloud hosted resources
Kubernetes cluster events deletion
A Kubernetes ephemeral container was created
Remote usage of VM Service Account token
GCP Service Account deletion
GCP Pub/Sub Topic Deletion
Activity in a dormant region of a cloud project
GCP IAM Custom Role Creation
Unusual resource modification/creation
Unusual Identity and Access Management (IAM) activity
Unusual secret management activity
GCP Virtual Private Network Route Deletion
A Kubernetes StatefulSet was created
Unusual certificate management activity
Cloud impersonation attempt by unusual identity type
A Kubernetes dashboard service account was used outside the cluster
Remote usage of an App engine Service Account token
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes Pod Created With Sensitive Volume
Unusual cross projects activity
Kubernetes pod creation with host network
GCP Pub/Sub Subscription Deletion
GCP IAM Role Deletion
A Kubernetes role binding was created or deleted
A container registry was created or deleted
GCP Logging Bucket Deletion
Billing admin role was removed
Penetration testing tool activity
A Kubernetes service account was created or deleted
Gcp Flow Log
An internal Cloud resource performed port scan on external networks
Google Workspace Audit Logs
Massive file downloads from SaaS service
External SaaS file-sharing activity
Massive upload to SaaS service
A mail forwarding rule was configured in Google Workspace
User accessed SaaS resource via anonymous link
A Google Workspace service was configured as unrestricted
A third-party application's access to the Google Workspace domain's resources was revoked
A Google Workspace Role privilege was deleted
Gmail routing settings changed
An app was added to the Google Workspace trusted OAuth apps list
A third-party application was authorized to access the Google Workspace APIs
A Google Workspace user was added to a group
A GCP service account was delegated domain-wide authority in Google Workspace
A domain was added to the trusted domains list
Google Workspace organizational unit was modified
A Google Workspace identity used the security investigation tool
Suspicious SaaS API call from a Tor exit node
Google Marketplace restrictions were modified
A Google Workspace user was removed from a group
A Google Workspace identity created, assigned or modified a role
External Sharing was turned on for Google Drive
An app was added to Google Marketplace
Data Sharing between GCP and Google Workspace was disabled
A Google Workspace identity performed an unusual admin console activity
An app was removed from a blocked list in Google Workspace
Admin privileges were granted to a Google Workspace user
MFA Disabled for Google Workspace
Gmail delegation was turned on for the organization
Google Workspace third-party application's security settings were changed
Office 365 Audit
Massive file downloads from SaaS service
User moved Exchange sent messages to deleted items
External SaaS file-sharing activity
Exchange mailbox delegation permissions added
Massive upload to SaaS service
A user uploaded malware to SharePoint or OneDrive
Exchange malware filter policy removed
User accessed SaaS resource via anonymous link
Exchange email-hiding inbox rule
Exchange audit log disabled
Exchange inbox forwarding rule configured
Penetration testing tool activity attempt
Microsoft 365 DLP policy disabled or removed
Exchange mailbox folder permission modification
SharePoint Site Collection admin group addition
Exchange transport forwarding rule configured
Exchange compliance search created
Exchange mailbox audit bypass
Exchange anti-phish policy disabled or removed
Suspicious SaaS API call from a Tor exit node
Exchange email-hiding transport rule
Exchange DKIM signing configuration disabled
Exchange user mailbox forwarding
Exchange Safe Link policy disabled or removed
Exchange Safe Attachment policy disabled or removed
Okta
SSO Password Spray
A user accessed multiple unusual resources via SSO
Intense SSO failures
Impossible traveler - SSO
A user rejected an SSO request from an unusual country
Multiple SSO MFA attempts were rejected by a user
SSO Brute Force
A disabled user attempted to authenticate via SSO
Suspicious SSO authentication
SSO with abnormal user agent
SSO with abnormal operating system
A user connected from a new country
A successful SSO sign-in from TOR
SSO authentication by a service account
SSO with new operating system
User attempted to connect from a suspicious country
First connection from a country in organization
OneLogin
SSO Password Spray
Intense SSO failures
SSO Brute Force
A disabled user attempted to authenticate via SSO
A user connected from a new country
A successful SSO sign-in from TOR
SSO authentication by a service account
User attempted to connect from a suspicious country
First connection from a country in organization
Palo Alto Networks Global Protect
VPN login Brute-Force attempt
Impossible traveler - VPN
A disabled user attempted to log in to a VPN
VPN login with a machine account
VPN login by a service account
VPN access with an abnormal operating system
A user connected to a VPN from a new country
First VPN access attempt from a country in organization
A user logged in at an unusual time via VPN
First VPN access from ASN for user
VPN login by a dormant user
A Successful VPN connection from TOR
First VPN access from ASN in organization
Palo Alto Networks Platform Logs
NTLM Password Spray
Rare LDAP enumeration
A user accessed multiple time-consuming websites
Upload pattern that resembles Peer to Peer traffic
DNS Tunneling
Random-Looking Domain Names
NTLM Relay
Large Upload (FTP)
NTLM Hash Harvesting
Suspicious ICMP traffic that resembles smurf attack
Suspicious DNS traffic
Spam Bot Traffic
Large Upload (SMTP)
Large Upload (HTTPS)
Kerberos Pre-Auth Failures by Host
Kerberos User Enumeration
Large Upload (Generic)
Kerberos Pre-Auth Failures by User and Host
Abnormal sensitive RPC traffic to multiple hosts
Increase in Job-Related Site Visits
Failed DNS
Massive upload to a rare storage or mail domain
Multiple Weakly-Encrypted Kerberos Tickets Received
Recurring access to rare IP
Possible DCShadow attempt
Rare NTLM Access By User To Host
Recurring rare domain access to dynamic DNS domain
Rare NTLM Usage by User
Rare Scheduled Task RPC activity
Failed Login For a Long Username With Special Characters
Possible Kerberoasting without SPNs
Bronze-Bit exploit
Abnormal network communication through TOR using an uncommon port
Suspicious SMB connection from domain controller
Suspicious domain suffix
Weakly-Encrypted Kerberos Ticket Requested
Possible use of IPFS was detected
A Torrent client was detected on a host
Suspicious failed HTTP request - potential Spring4Shell exploit
Authentication Attempt From a Dormant Account
Rare AppID usage to a rare destination
Possible IPFS traffic was detected
A Possible crypto miner was detected on a host
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
A user accessed an uncommon AppID
Suspicious ICMP packet
Failed Login For Locked-Out Account
Palo Alto Networks Url Logs
A non-browser process accessed a website UI
Non-browser access to a pastebin-like site
PowerShell Initiates a Network Connection to GitHub
Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
Uncommon network tunnel creation
PingOne
A disabled user attempted to authenticate via SSO
A user connected from a new country
A successful SSO sign-in from TOR
SSO authentication by a service account
User attempted to connect from a suspicious country
First connection from a country in organization
Third-Party Firewalls
HTTP with suspicious characteristics
New Administrative Behavior
Large Upload (HTTPS)
Port Scan
Failed Connections
Recurring access to rare IP
Recurring rare domain access to dynamic DNS domain
Rare SMTP/S Session
Suspicious SMB connection from domain controller
A Torrent client was detected on a host
Rare AppID usage to a rare destination
Third-Party VPNs
VPN login Brute-Force attempt
Impossible traveler - VPN
A disabled user attempted to log in to a VPN
VPN login with a machine account
VPN login by a service account
VPN access with an abnormal operating system
A user connected to a VPN from a new country
First VPN access attempt from a country in organization
A user logged in at an unusual time via VPN
First VPN access from ASN for user
VPN login by a dormant user
A Successful VPN connection from TOR
First VPN access from ASN in organization
Windows Event Collector
Interactive local account enumeration
Short-lived user account
Excessive user account lockouts
A user printed an unusual number of files
A user sent multiple TGT requests to irregular service
Multiple suspicious user accounts were created
Multiple TGT requests for users without Kerberos pre-authentication
User added to a group and removed
Multiple user accounts were deleted
A new machine attempted Kerberos delegation
Possible Brute-Force attempt
A user logged on to multiple workstations via Schannel
Brute-force attempt on a local account
A user authenticated with weak NTLM to multiple hosts
Remote account enumeration
Multiple users authenticated with weak NTLM to a host
Account probing
A user received multiple weakly encrypted service tickets
A user was added to a Windows security group
Suspicious modification of the AdminSDHolder's ACL
Sensitive account password reset attempt
Unusual weak authentication by user
A machine certificate was issued with a mismatch
TGT request with a spoofed sAMAccountName - Event log
A rare local administrator login
A user account was modified to password never expires
A user certificate was issued with a mismatch
Interactive login by a service account
Machine account was added to a domain admins group
Mailbox Client Access Setting (CAS) changed
Interactive login by a machine account
Rare machine account creation
Possible Pass-the-Hash
A Successful login from TOR
SPNs cleared from a machine account
Suspicious hidden user created
Discovery of misconfigured certificate templates using LDAP
PowerShell used to remove mailbox export request logs
A computer account was promoted to DC
A user enabled a default local account
Service ticket request with a spoofed sAMAccountName
Masquerading as a default local account
Suspicious local user account creation
PowerShell used to export mailbox contents
Possible Kerberos relay attack
User added SID History to an account
Interactive login from a shared user account
Security tools detection attempt
Suspicious domain user account creation
User account delegation change
Suspicious sAMAccountName change
A user changed the Windows system time
A user logged in from an abnormal country or ASN
Administrator groups enumerated via LDAP
VM Detection attempt
XDR Agent
NTLM Password Spray
Possible brute force on sudo user
Possible internal data exfiltration over a USB storage device
Interactive local account enumeration
NTLM Brute Force on a Service Account
Short-lived user account
A user accessed an abnormal number of remote shared folders
Suspicious access to cloud credential files
Upload pattern that resembles Peer to Peer traffic
Excessive user account lockouts
DNS Tunneling
Multiple discovery commands on a Linux host by the same process
Random-Looking Domain Names
A user printed an unusual number of files
Multiple Rare LOLBIN Process Executions by User
NTLM Brute Force
A user sent multiple TGT requests to irregular service
A user took numerous screenshots
SSH authentication brute force attempts
Multiple suspicious user accounts were created
Possible LDAP enumeration by unsigned process
Suspicious reconnaissance using LDAP
HTTP with suspicious characteristics
Multiple TGT requests for users without Kerberos pre-authentication
User collected remote shared files in an archive
NTLM Relay
Possible data exfiltration over a USB storage device
User added to a group and removed
Large Upload (FTP)
Multiple discovery commands on a Windows host by the same process
Multiple user accounts were deleted
NTLM Hash Harvesting
Suspicious ICMP traffic that resembles smurf attack
Sudoedit Brute force attempt
Abnormal SMB activity to multiple hosts
Suspicious DNS traffic
A new machine attempted Kerberos delegation
A user connected a new USB storage device to multiple hosts
Spam Bot Traffic
Possible Brute-Force attempt
A user logged on to multiple workstations via Schannel
A contained process attempted to escape using the 'notify on release' feature
User and Group Enumeration via SAMR
New Administrative Behavior
Brute-force attempt on a local account
A user authenticated with weak NTLM to multiple hosts
Large Upload (SMTP)
TGT reuse from different hosts (pass the ticket)
Massive file activity abnormal to process
Multiple discovery-like commands
A user accessed an abnormal number of files on a remote shared folder
Large Upload (HTTPS)
Outlook files accessed by an unsigned process
Port Scan
Kerberos Pre-Auth Failures by Host
Multiple discovery commands
Kerberos User Enumeration
Remote account enumeration
New Shared User Account
Large Upload (Generic)
Kerberos Pre-Auth Failures by User and Host
Suspicious container reconnaissance activity in a Kubernetes pod
Massive file compression by user
Abnormal sensitive RPC traffic to multiple hosts
Multiple users authenticated with weak NTLM to a host
A user performed suspiciously massive file activity
Failed Connections
Account probing
Possible brute force or configuration change attempt on cytool
Possible external RDP Brute-Force
NTLM Brute Force on an Administrator Account
A user received multiple weakly encrypted service tickets
External Login Password Spray
Failed DNS
Multiple Rare Process Executions in Organization
Massive upload to a rare storage or mail domain
Multiple Weakly-Encrypted Kerberos Tickets Received
Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
Injection into rundll32.exe
Uncommon msiexec execution of an arbitrary file from a remote location
Wsmprovhost.exe Rare Child Process
Unusual ADConnect database file access
A user was added to a Windows security group
Rundll32.exe executes a rare unsigned module
Suspicious modification of the AdminSDHolder's ACL
Suspicious process accessed a site masquerading as Google
Rare signature signed executable executed in the network
Space after filename
Recurring access to rare IP
Installation of a new System-V service
Suspicious docker image download from an unusual repository
Rare scheduled task created
Keylogging using system commands
A suspicious executable with multiple file extensions was created
Phantom DLL Loading
Possible DCShadow attempt
Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
Possible Email collection using Outlook RPC
Suspicious PowerSploit's recon module (PowerView) net function was executed
Rare NTLM Access By User To Host
Unusual access to the Windows Internal Database on an ADFS server
Commonly abused AutoIT script drops an executable file to disk
Recurring rare domain access to dynamic DNS domain
Suspicious PowerShell Enumeration of Running Processes
PowerShell pfx certificate extraction
Iptables configuration command was executed
Kerberos Traffic from Non-Standard Process
Elevation to SYSTEM via services
Possible Persistence via group policy Registry keys
Globally uncommon root-domain port combination from a signed process
Suspicious RunOnce Parent Process
Rare NTLM Usage by User
Unusual Kubernetes dashboard communication from a pod
Network traffic to a crypto miner related domain detected
Sensitive account password reset attempt
New process created via a WMI call
Rare Scheduled Task RPC activity
Suspicious Print System Remote Protocol usage by a process
Suspicious print processor registered
Globally uncommon high entropy module was loaded
Possible network sniffing attempt via tcpdump or tshark
Suspicious data encryption
Unusual AWS credentials creation
Registration of Uncommon .NET Services and/or Assemblies
WebDAV drive mounted from net.exe over HTTPS
Unusual weak authentication by user
Possible use of a networking driver for network sniffing
Wscript/Cscript loads .NET DLLs
Unusual AWS user added to group
A machine certificate was issued with a mismatch
Encoded information using Windows certificate management tool
Suspicious active setup registered
A remote service was created via RPC over SMB
Cloud Unusual Instance Metadata Service (IMDS) access
Login by a dormant user
Bitsadmin.exe persistence using command-line callback
TGT request with a spoofed sAMAccountName - Event log
Uncommon IP Configuration Listing via ipconfig.exe
Uncommon ARP cache listing via arp.exe
Possible data obfuscation
Globally uncommon injection from a signed process
Masquerading as the Linux crond process
LOLBIN process executed with a high integrity level
File transfer from unusual IP using known tools
Windows Installer exploitation for local privilege escalation
Compressing data using python
Uncommon DotNet module load relationship
Unicode RTL Override Character
Suspicious authentication package registered
Conhost.exe spawned a suspicious child process
A suspicious process queried AD CS objects via LDAP
Suspicious access to shadow file
A rare local administrator login
Setuid and Setgid file bit manipulation
Possible binary padding using dd
A user account was modified to password never expires
Uncommon net localgroup execution
Possible collection of screen captures with Windows Problem Steps Recorder
SecureBoot was disabled
Windows LOLBIN executable connected to a rare external host
Uncommon kernel module load
Microsoft Office injects code into a process
Possible new DHCP server
Failed Login For a Long Username With Special Characters
A user certificate was issued with a mismatch
Office process accessed an unusual .LNK file
Rare Unix process divided files by size
Indirect command execution using the Program Compatibility Assistant
Modification of NTLM restrictions in the Registry
A compiled HTML help file wrote a script file to the disk
Signed process performed an unpopular injection
Office process creates a scheduled task via file access
Suspicious PowerShell Command Line
Suspicious proxy environment variable setting
Mshta.exe launched with suspicious arguments
Execution of renamed lolbin
Suspicious process execution in a privileged container
Interactive login by a service account
VM Detection attempt on Linux
System shutdown or reboot
Machine account was added to a domain admins group
Windows event logs were cleared with PowerShell
Globally uncommon root-domain port combination by a common process (sha256)
Mailbox Client Access Setting (CAS) changed
Interactive login by a machine account
Rare process execution by user
Suspicious certutil command line
Possible RDP session hijacking using tscon.exe
Change of sudo caching configuration
Possible Kerberoasting without SPNs
Unusual compressed file password protection
Autorun.inf created in root C drive
Remote DCOM command execution
Unpopular rsync process execution
Download a script using the python requests module
Svchost.exe loads a rare unsigned module
Unusual Kubernetes API server communication from a pod
Suspicious container orchestration job
Command execution in a Kubernetes pod
Uncommon local scheduled task creation via schtasks.exe
Suspicious SearchProtocolHost.exe parent process
The Linux system firewall was disabled
Unusual use of a 'SysInternals' tool
Possible Search For Password Files
Unprivileged process opened a registry hive
Suspicious process executed with a high integrity level
Kubernetes version disclosure
Manipulation of netsh helper DLLs Registry keys
Rare WinRM Session
Suspicious time provider registered
Remote WMI process execution
Script file added to startup-related Registry keys
Bronze-Bit exploit
WmiPrvSe.exe Rare Child Command Line
Suspicious process modified RC script file
Possible DLL Hijack into a Microsoft process
Remote code execution into Kubernetes Pod
Rare SMTP/S Session
Rare communication over email ports to external email server by unsigned process
SUID/GUID permission discovery
Hidden Attribute was added to a file using attrib.exe
Rundll32.exe running with no command-line arguments
Delayed Deletion of Files
Uncommon Security Support Provider (SSP) registered via a registry key
Suspicious User Login to Domain Controller
LDAP search query from an unpopular and unsigned process
Rare machine account creation
Uncommon PowerShell commands used to create or alter scheduled task parameters
Attempt to execute a command on a remote host using PsExec.exe
Unusual Azure AD sync module load
LOLBIN created a PSScriptPolicyTest PowerShell script file
Suspicious runonce.exe parent process
Globally uncommon high entropy process was executed
RDP Connection to localhost
Possible Pass-the-Hash
Office process spawned with suspicious command-line arguments
A user created an abnormal password-protected archive
A Successful login from TOR
LSASS dump file written to disk
A suspicious process enrolled for a certificate
Process execution with a suspicious command line indicative of the Spring4Shell exploit
SPNs cleared from a machine account
Permission Groups discovery commands
Suspicious module load using direct syscall
Suspicious systemd timer activity
Signed process performed an unpopular DLL injection
An uncommon executable was remotely written over SMB to an uncommon destination
Uncommon remote service start via sc.exe
Suspicious hidden user created
Discovery of misconfigured certificate templates using LDAP
Modification of PAM
PowerShell used to remove mailbox export request logs
A computer account was promoted to DC
Service execution via sc.exe
A user enabled a default local account
Service ticket request with a spoofed sAMAccountName
New addition to Windows Defender exclusion list
Uncommon creation or access operation of sensitive shadow copy
Extracting credentials from Unix files
Reading bash command history file
Rare Windows Remote Management (WinRM) HTTP Activity
Globally uncommon image load from a signed process
Masquerading as a default local account
MpCmdRun.exe was used to download files into the system
Suspicious local user account creation
PowerShell suspicious flags
Uncommon routing table listing via route.exe
User discovery via WMI query execution
Suspicious Certutil AD CS contact
Screensaver process executed from Users or temporary folder
A contained executable was executed by an unusual process
Adding execution privileges
RDP connections enabled remotely via Registry
A process was executed with a command line obfuscated by Unicode character substitution
Local account discovery
Abnormal network communication through TOR using an uncommon port
PsExec was executed with a suspicious command line
Uncommon Managed Object Format (MOF) compiler usage
Suspicious SMB connection from domain controller
Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
Remote command execution via wmic.exe
An unusual archive file creation by a user
Scrcons.exe Rare Child Process
Uncommon access to Microsoft Teams credential files
A disabled user attempted to log in
Suspicious External RDP Login
MSI accessed a web page running a server-side script
PowerShell used to export mailbox contents
Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
Possible DCSync from a non domain controller
Possible Kerberos relay attack
A user added a Windows firewall rule
The CA policy EditFlags was queried
Python HTTP server started
A LOLBIN was copied to a different location
An uncommon service was started
Commonly abused process launched as a system service
User added SID History to an account
Interactive login from a shared user account
A WMI subscriber was created
Vulnerable driver loaded
Uncommon RDP connection
Possible compromised machine account
Remote PsExec-like command execution
Suspicious sshpass command execution
Rundll32.exe spawns conhost.exe
Executable moved to Windows system folder
Microsoft Office process spawns a commonly abused process
Unusual Lolbins Process Spawned by InstallUtil.exe
Suspicious disablement of the Windows Firewall using PowerShell commands
A process connected to a rare external host
Suspicious domain suffix
Weakly-Encrypted Kerberos Ticket Requested
Unusual process accessed the PowerShell history file
Uncommon GetClipboardData API function invocation of a possible information stealer
Procdump executed from an atypical directory
Creation or modification of the default command executed when opening an application
Interactive at.exe privilege escalation method
Unsigned process creates a scheduled task via file access
Contained process execution with a rare GitHub URL
Uncommon AT task-job creation by user
Suspicious DotNet log file created
Tampering with Internet Explorer Protected Mode configuration
Uncommon net group or localgroup execution
Stored credentials exported using credwiz.exe
Uncommon SSH session was established
Commonly abused AutoIT script connects to an external domain
Rare SSH Session
Possible use of IPFS was detected
A Torrent client was detected on a host
Suspicious LDAP search query executed
Suspicious process execution from tmp folder
Unusual access to the AD Sync credential files
Linux system firewall was modified
Image file execution options (IFEO) registry key set
A browser was opened in private mode
Memory dumping with comsvcs.dll
Suspicious Udev driver rule execution manipulation
Editing ld.so.preload for persistence and injection
Uncommon user management via net.exe
Scheduled Task hidden by registry modification
Microsoft Office Process Spawning a Suspicious One-Liner
Microsoft Office adds a value to autostart Registry key
Cached credentials discovery with cmdkey
Suspicious process changed or created the ssh_authorized_keys file
Reverse SSH tunnel to external domain/ip
Suspicious failed HTTP request - potential Spring4Shell exploit
Suspicious container runtime connection from within a Kubernetes Pod
Suspicious process loads a known PowerShell module
Unsigned and unpopular process performed an injection
System profiling WMI query execution
Authentication Attempt From a Dormant Account
Security tools detection attempt
Suspicious usage of File Server Remote VSS Protocol (FSRVP)
Rare DCOM RPC activity
Suspicious disablement of the Windows Firewall
System information discovery via psinfo.exe
PowerShell runs suspicious base64-encoded commands
Suspicious domain user account creation
LDAP Traffic from Non-Standard Process
Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
A user connected a USB storage device for the first time
Possible DLL Side-Loading
Possible network service discovery via command-line tool
Discovery of host users via WMIC
Msiexec execution of an executable from an uncommon remote location
Execution of dllhost.exe with an empty command line
Abnormal process connection to default Meterpreter port
Rare AppID usage to a rare destination
Suspicious curl user agent
User account delegation change
Rare process execution in organization
Rare service DLL was added to the registry
Kubernetes nsenter container escape
Suspicious process execution by scheduled task
Wbadmin deleted files in quiet mode
Rare LOLBIN Process Execution by User
Unsigned and unpopular process performed a DLL injection
Remote service start from an uncommon source
Uncommon jsp file write by a Java process
An uncommon file added to startup-related Registry keys
Possible Microsoft process masquerading
SMB Traffic from Non-Standard Process
Suspicious .NET process loads an MSBuild DLL
Suspicious AMSI decode attempt
Suspicious sAMAccountName change
Possible IPFS traffic was detected
Sensitive browser credential files accessed by a rare non browser process
Recurring rare domain access from an unsigned process
Suspicious Process Spawned by Adobe Reader
A user changed the Windows system time
Globally uncommon IP address connection from a signed process
Browser bookmark files accessed by a rare non-browser process
Execution of the Hydra Linux password brute-force tool
Indicator blocking
Unsigned process injecting into a Windows system binary with no command line
Remote service command execution from an uncommon source
Unusual Kubernetes service account file read
An uncommon file was created in the startup folder
A suspicious direct syscall was executed
A Possible crypto miner was detected on a host
A user logged in from an abnormal country or ASN
Netcat makes or gets connections
A user created a pfx file for the first time
Uncommon SetWindowsHookEx API invocation of a possible keylogger
TGT request with a spoofed sAMAccountName - Network
Suspicious execution of ODBCConf
Fodhelper.exe UAC bypass
Tampering with the Windows User Account Controls (UAC) configuration
DSC (Desired State Configuration) lateral movement using PowerShell
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
Possible DLL Search Order Hijacking
LOLBAS executable injects into another process
Administrator groups enumerated via LDAP
Kubernetes vulnerability scanner activity
Executable created to disk by lsass.exe
Run downloaded script using pipe
Uncommon remote scheduled task creation
Globally uncommon process execution from a signed process
A service was disabled
A TCP stream was created directly in a shell
Browser Extension Installed
Copy a user's GnuPG directory with rsync
Globally uncommon IP address by a common process (sha256)
Mimikatz command-line arguments
Rare process spawned by srvany.exe
Kubernetes secret enumeration activity
Globally uncommon root domain from a signed process
Ping to localhost from an uncommon, unsigned parent process
Uncommon Service Create/Config
A contained executable from a mounted share initiated a suspicious outbound network connection
An unpopular process accessed the microphone on the host
Possible code downloading from a remote host by Regsvr32
A user accessed an uncommon AppID
Suspicious process accessed certificate files
Certutil pfx parsing
Rare file transfer over SMB protocol
Possible malicious .NET compilation started by a commonly abused process
Rare security product signed executable executed in the network
Suspicious ICMP packet
Possible Distributed File System Namespace Management (DFSNM) abuse
Command running with COMSPEC in the command line argument
Copy a process memory file
Windows Event Log was cleared using wevtutil.exe
Command execution via wmiexec
Uncommon communication to an instant messaging server
VM Detection attempt
A user connected a new USB storage device to a host
A compressed file was exfiltrated over SSH
Suspicious Process Spawned by wininit.exe
Failed Login For Locked-Out Account
eXtended Threat Hunting (XTH)
Possible internal data exfiltration over a USB storage device
Short-lived user account
A user accessed an abnormal number of remote shared folders
Suspicious access to cloud credential files
Excessive user account lockouts
A user printed an unusual number of files
A user sent multiple TGT requests to irregular service
A user took numerous screenshots
Multiple suspicious user accounts were created
Possible LDAP enumeration by unsigned process
Suspicious reconnaissance using LDAP
Multiple TGT requests for users without Kerberos pre-authentication
User collected remote shared files in an archive
Possible data exfiltration over a USB storage device
User added to a group and removed
Multiple user accounts were deleted
A new machine attempted Kerberos delegation
A user connected a new USB storage device to multiple hosts
A contained process attempted to escape using the 'notify on release' feature
User and Group Enumeration via SAMR
Massive file activity abnormal to process
A user accessed an abnormal number of files on a remote shared folder
Outlook files accessed by an unsigned process
Massive file compression by user
A user performed suspiciously massive file activity
A user received multiple weakly encrypted service tickets
Unusual ADConnect database file access
A user was added to a Windows security group
Suspicious modification of the AdminSDHolder's ACL
Space after filename
Rare scheduled task created
A suspicious executable with multiple file extensions was created
Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
Suspicious PowerSploit's recon module (PowerView) net function was executed
Unusual access to the Windows Internal Database on an ADFS server
Commonly abused AutoIT script drops an executable file to disk
PowerShell pfx certificate extraction
Elevation to SYSTEM via services
Possible Persistence via group policy Registry keys
Sensitive account password reset attempt
New process created via a WMI call
Suspicious Print System Remote Protocol usage by a process
Possible use of a networking driver for network sniffing
A machine certificate was issued with a mismatch
Suspicious active setup registered
A remote service was created via RPC over SMB
TGT request with a spoofed sAMAccountName - Event log
A suspicious process queried AD CS objects via LDAP
Suspicious access to shadow file
A user account was modified to password never expires
SecureBoot was disabled
A user certificate was issued with a mismatch
Office process accessed an unusual .LNK file
Modification of NTLM restrictions in the Registry
A compiled HTML help file wrote a script file to the disk
Machine account was added to a domain admins group
Windows event logs were cleared with PowerShell
Mailbox Client Access Setting (CAS) changed
Change of sudo caching configuration
Unusual use of a 'SysInternals' tool
Suspicious process modified RC script file
Uncommon Security Support Provider (SSP) registered via a registry key
LDAP search query from an unpopular and unsigned process
Rare machine account creation
Uncommon PowerShell commands used to create or alter scheduled task parameters
LOLBIN created a PSScriptPolicyTest PowerShell script file
A user created an abnormal password-protected archive
LSASS dump file written to disk
SPNs cleared from a machine account
An uncommon executable was remotely written over SMB to an uncommon destination
Suspicious hidden user created
Discovery of misconfigured certificate templates using LDAP
PowerShell used to remove mailbox export request logs
A computer account was promoted to DC
A user enabled a default local account
Service ticket request with a spoofed sAMAccountName
Uncommon creation or access operation of sensitive shadow copy
Masquerading as a default local account
Suspicious local user account creation
User discovery via WMI query execution
RDP connections enabled remotely via Registry
An unusual archive file creation by a user
Uncommon access to Microsoft Teams credential files
PowerShell used to export mailbox contents
Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
A user added a Windows firewall rule
User added SID History to an account
A WMI subscriber was created
Suspicious disablement of the Windows Firewall using PowerShell commands
Uncommon GetClipboardData API function invocation of a possible information stealer
Creation or modification of the default command executed when opening an application
Uncommon AT task-job creation by user
Suspicious DotNet log file created
Suspicious LDAP search query executed
Unusual access to the AD Sync credential files
Linux system firewall was modified
Image file execution options (IFEO) registry key set
Suspicious Udev driver rule execution manipulation
Editing ld.so.preload for persistence and injection
Scheduled Task hidden by registry modification
Microsoft Office adds a value to autostart Registry key
Suspicious process changed or created the ssh_authorized_keys file
System profiling WMI query execution
Security tools detection attempt
Suspicious domain user account creation
Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
A user connected a USB storage device for the first time
User account delegation change
Rare service DLL was added to the registry
Uncommon jsp file write by a Java process
An uncommon file added to startup-related Registry keys
Suspicious AMSI decode attempt
Suspicious sAMAccountName change
Sensitive browser credential files accessed by a rare non browser process
A user changed the Windows system time
Browser bookmark files accessed by a rare non-browser process
Unusual Kubernetes service account file read
An uncommon file was created in the startup folder
A suspicious direct syscall was executed
A user created a pfx file for the first time
Uncommon SetWindowsHookEx API invocation of a possible keylogger
Tampering with the Windows User Account Controls (UAC) configuration
DSC (Desired State Configuration) lateral movement using PowerShell
Administrator groups enumerated via LDAP
Executable created to disk by lsass.exe
Browser Extension Installed
An unpopular process accessed the microphone on the host
Suspicious process accessed certificate files
Possible Distributed File System Namespace Management (DFSNM) abuse
VM Detection attempt
A user connected a new USB storage device to a host

Back to home page