DropBox

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2025-03-18
Category: Analytics Alert Reference
Index by: data source

Cortex XDR Analytics Alert Reference
Required Data Sources
AWS Audit Log
Suspicious identity downloaded multiple objects from a bucket
An identity performed a suspicious download of multiple cloud storage objects
Multiple cloud snapshots export
Cloud user performed multiple actions that were denied
Storage enumeration activity
Kubernetes enumeration activity
Multi region enumeration activity
Deletion of multiple cloud resources
Cloud infrastructure enumeration activity
Allocation of multiple cloud compute resources
Suspicious objects encryption in an AWS bucket
IAM Enumeration sequence
An identity dumped multiple secrets from a project
Multiple failed logins from a single IP
Abnormal Allocation of compute resources in multiple regions
A Kubernetes ephemeral container was created
Unusual resource modification by newly seen IAM user
A Kubernetes Pod was created with a sidecar container
AWS Role Trusted Entity modification
AWS IAM resource group deletion
A Kubernetes node service account activity from external IP
A Kubernetes StatefulSet was created
Unusual Identity and Access Management (IAM) activity
AWS SSM send command attempt
AWS SecurityHub findings were modified
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes cluster events deletion
A Kubernetes role binding was created or deleted
A Kubernetes service was created or deleted
Aurora DB cluster stopped
AWS Cloud Trail log trail modification
A cloud snapshot was created or modified
An IAM group was created
A Kubernetes ReplicaSet was created
An AWS Lambda Function was created
An identity created or updated password for an IAM user
A cloud function was created with an unusual runtime
S3 configuration deletion
An AWS GuardDuty IP set was created
A Kubernetes deployment was created
An identity started an AWS SSM session
AWS Config Recorder stopped
An AWS S3 bucket configuration was modified
Disable encryption operations
AWS Guard-Duty detector deletion
An AWS database service master user password was changed
Penetration testing tool activity
Kubernetes network policy modification
An AWS Route 53 domain was transferred to another AWS account
A Kubernetes Pod was deleted
Unusual IAM enumeration activity by a non-user Identity
A Kubernetes API operation was successfully invoked by an anonymous user
Cloud identity reached a throttling API rate
Cloud compute instance user data script modification
AWS Flow Logs deletion
A Kubernetes cluster role binding was created or deleted
A Kubernetes namespace was created or deleted
An AWS ElastiCache security group was created
AWS config resource deletion
An identity attached an administrative policy to an IAM user/role
Unusual AWS systems manager activity
A user logged in to the AWS console for the first time
An AWS Lambda function was modified
An AWS SES Email sending settings were modified
An AWS SES identity was deleted
Unusual key management activity
An AWS RDS instance was created from a snapshot
Cloud snapshot of a database or storage instance was publicly shared
AWS CloudWatch log group deletion
Unusual secret management activity
A Kubernetes secret was created or deleted
An AWS RDS Global Cluster Deletion
Unusual cloud identity impersonation
An identity disabled bucket logging
An AWS EKS cluster was created or deleted
A Command Line Interface (CLI) command was executed from an AWS serverless compute service
An AWS EFS File-share mount was deleted
Remote usage of an AWS service token
AWS network ACL rule deletion
An AWS EFS file-share was deleted
Cloud storage delete protection disabled
Network sniffing detected in Cloud environment
Kubernetes service account activity outside the cluster
Cloud Trail logging deletion
IAM User added to an IAM group
AWS data asset shared public
A Kubernetes service account has enumerated its permissions
A cloud identity had escalated its permissions
Suspicious cloud compute instance ssh keys modification attempt
A Kubernetes dashboard service account was used outside the cluster
Kubernetes Privileged Pod Creation
AWS user creation
AWS Root account activity
MFA device was removed/deactivated from an IAM user
AWS STS temporary credentials were generated
Cloud storage automatic backup disabled
An Email address was added to AWS SES
AWS CloudWatch log stream deletion
Kubernetes admission controller activity
An operation was performed by an identity from a domain that was not seen in the organization
Kubernetes pod creation from unknown container image registry
A cloud storage configuration was modified
Cloud compute serial console access
A cloud instance was stopped
AWS network ACL rule creation
AWS web ACL deletion
A Kubernetes cluster was created or deleted
Unusual cross projects activity
A Kubernetes service account was created or deleted
Cloud impersonation attempt by unusual identity type
Object versioning was disabled
Unusual exec into a Kubernetes Pod
Unusual resource modification/creation
A cloud identity invoked IAM related persistence operations
Suspicious API call from a Tor exit node
Cloud email service activity
A Kubernetes ConfigMap was created or deleted
A Kubernetes DaemonSet was created
Kubernetes Pod created with host process ID (PID) namespace
Billing admin role was removed
Kubernetes pod creation with host network
Unusual certificate management activity
EC2 snapshot attribute has been modified
A cloud identity executed an API call from an unusual country
AWS EC2 instance exported into S3
Suspicious usage of EC2 token
A Kubernetes Cronjob was created
Kubernetes Pod Created With Sensitive Volume
Denied API call by a Kubernetes service account
Cloud unusual access key creation
An AWS ElastiCache security group was modified or deleted
A compute-attached identity executed API calls outside the instance's region
Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
Activity in a dormant region of a cloud project
Data encryption was disabled
Kubernetes vulnerability scanning tool usage
Cloud Watch alarm deletion
A cloud identity created or modified a security group
Remote usage of AWS Lambda's role
Penetration testing tool attempt
AWS RDS cluster deletion
A container registry was created or deleted
An AWS SAML provider was modified
Cloud Trail Logging has been stopped/suspended
A Kubernetes service account executed an unusual API call
AWS Flow Log
An internal Cloud resource performed port scan on external networks
SSH brute force attempt
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
AWS OCSF Flow Logs
An internal Cloud resource performed port scan on external networks
SSH brute force attempt
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
Azure Audit Log
Microsoft OneDrive enumeration activity
Microsoft Teams enumeration activity
Suspicious identity downloaded multiple objects from a bucket
Azure uncommon increase in API request sizes
An identity performed a suspicious download of multiple cloud storage objects
Multiple cloud snapshots export
Cloud user performed multiple actions that were denied
Storage enumeration activity
Kubernetes enumeration activity
Multi region enumeration activity
Microsoft SharePoint enumeration activity
Deletion of multiple cloud resources
Microsoft OneNote enumeration activity
Azure enumeration activity using Microsoft Graph API
Allocation of multiple cloud compute resources
An identity dumped multiple secrets from a project
Mailbox enumeration activity by Azure application
Multiple failed logins from a single IP
An Azure identity performed multiple actions that were denied
Abnormal Allocation of compute resources in multiple regions
A Kubernetes ephemeral container was created
Unusual resource modification by newly seen IAM user
Azure Storage Account key generated
Azure user creation/deletion
A Service Principal was created in Azure
Azure Automation Runbook Deletion
A Kubernetes Pod was created with a sidecar container
A Kubernetes node service account activity from external IP
A Kubernetes StatefulSet was created
An Azure VPN Connection was modified
Azure diagnostic configuration deletion
An Azure Network Security Group was modified
Authentication method was added to Azure account
OneDrive file upload
An Azure Key Vault was modified
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes cluster events deletion
A Kubernetes role binding was created or deleted
A Kubernetes service was created or deleted
Azure mailbox rule creation
Azure Event Hub Authorization rule creation/modification
A cloud snapshot was created or modified
A Kubernetes ReplicaSet was created
An Azure virtual network was modified
Azure Automation Runbook Creation/Modification
Azure Event Hub Deletion
PIM privilege member removal
Azure permission delegation granted
External user invitation to Azure tenant
A Kubernetes deployment was created
Azure application removed
Azure virtual machine commands execution
An Azure Key Vault key was modified
Penetration testing tool activity
Azure Key Vault Secrets were modified
Kubernetes network policy modification
Remote usage of an Azure Service Principal token
A Kubernetes Pod was deleted
A Kubernetes API operation was successfully invoked by an anonymous user
An Azure firewall rule group was modified
Cloud identity reached a throttling API rate
Credentials were added to Azure application
An Azure virtual network Device was modified
Azure Service principal/Application creation
A Kubernetes cluster role binding was created or deleted
A Kubernetes namespace was created or deleted
Azure Key Vault modification
Unusual key management activity
Privileged role used by Azure application
Unusual secret management activity
A Kubernetes secret was created or deleted
An Azure Firewall policy deletion
Azure Network Watcher Deletion
An Azure DNS Zone was modified
Cloud storage delete protection disabled
Network sniffing detected in Cloud environment
Azure Blob Container Access Level Modification
OneDrive file download
Kubernetes service account activity outside the cluster
An Azure Kubernetes Role or Cluster-Role was modified
Soft delete of cloud storage configuration was disabled
A Kubernetes service account has enumerated its permissions
A cloud identity had escalated its permissions
Attempted Azure application access from unknown tenant
Suspicious cloud compute instance ssh keys modification attempt
A Kubernetes dashboard service account was used outside the cluster
Kubernetes Privileged Pod Creation
An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted
An Azure Suppression Rule was created
Azure Resource Group Deletion
Azure group creation/deletion
Azure Automation Account Creation
Cloud storage automatic backup disabled
OneDrive folder creation
Kubernetes admission controller activity
An Azure application reached a throttling API rate
An Azure Kubernetes Cluster was created or deleted
An identity was granted permissions to manage user access to Azure resources
Azure user password reset
An operation was performed by an identity from a domain that was not seen in the organization
Kubernetes pod creation from unknown container image registry
A cloud storage configuration was modified
Cloud compute serial console access
A cloud instance was stopped
A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
Azure conditional access policy creation or modification
Removal of an Azure Owner from an Application or Service Principal
A Kubernetes cluster was created or deleted
Unusual cross projects activity
A Kubernetes service account was created or deleted
Azure device code authentication flow used
Object versioning was disabled
Granting Access to an Account
An Azure Firewall Rule Collection was modified
Unusual exec into a Kubernetes Pod
An Azure Kubernetes Service Account was modified or deleted
Unusual resource modification/creation
A cloud identity invoked IAM related persistence operations
Suspicious API call from a Tor exit node
Cloud email service activity
Azure storage account cross-tenant object replication was enabled
A Kubernetes ConfigMap was created or deleted
A Kubernetes DaemonSet was created
Kubernetes Pod created with host process ID (PID) namespace
Owner was added to Azure application
Billing admin role was removed
Kubernetes pod creation with host network
Unusual certificate management activity
A cloud identity executed an API call from an unusual country
Modification or Deletion of an Azure Application Gateway Detected
Azure storage account blob anonymous access is enabled
A Kubernetes Cronjob was created
Kubernetes Pod Created With Sensitive Volume
Denied API call by a Kubernetes service account
An identity accessed Azure Kubernetes Secrets
Azure Kubernetes events were deleted
Azure storage account was publicly shared
Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
An Azure Cloud Shell was Created
Azure Automation Webhook creation
Remote usage of an Azure Managed Identity token
Activity in a dormant region of a cloud project
Kubernetes vulnerability scanning tool usage
A cloud identity created or modified a security group
An Azure Point-to-Site VPN was modified
A Service Principal was removed from Azure
A container registry was created or deleted
An Azure Firewall was modified
Unusual resource access by Azure application
A Kubernetes service account executed an unusual API call
Azure Flow Log
An internal Cloud resource performed port scan on external networks
SSH brute force attempt
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
Azure SignIn Log
Intense SSO failures
SSO Brute Force
A user accessed multiple unusual resources via SSO
Impossible traveler - SSO
SSO Password Spray
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO authentication by a machine account
SSO with abnormal user agent
Suspicious SSO access from ASN
First connection from a country in organization
SSO with new operating system
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
AzureAD
Intense SSO failures
SSO Brute Force
A user accessed multiple unusual resources via SSO
Impossible traveler - SSO
SSO Password Spray
Suspicious Azure AD interactive sign-in using PowerShell
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO with abnormal operating system
SSO authentication by a machine account
SSO with abnormal user agent
Suspicious SSO access from ASN
First connection from a country in organization
Suspicious authentication with Azure Password Hash Sync user
SSO with new operating system
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
SSO authentication attempt by a honey user
AzureAD Audit Log
Short-lived Azure AD user account
Multiple Azure AD admin role removals
Identity assigned an Azure AD Administrator Role
First Azure AD PowerShell operation for a user
Azure Temporary Access Pass (TAP) registered to an account
Azure AD PIM alert disabled
Azure AD account unlock/password reset attempt
Authentication method added to an Azure account
BitLocker key retrieval
Azure account deletion by a non-standard account
Unusual Conditional Access operation for an identity
Azure service principal assigned app role
Owner added to Azure application
Azure domain federation settings modification attempt
Azure AD PIM role settings change
Azure audit - MFA fraud reported
Conditional Access policy removed
Device Registration Policy modification
Azure application consent
Azure application credentials added
MFA was disabled for an Azure identity
Unverified domain added to Azure AD
Azure AD PIM elevation request
Azure application URI modification
Successful unusual guest user invitation
Azure account creation by a non-standard account
Box Audit Log
External SaaS file-sharing activity
Massive upload to SaaS service
Massive file downloads from SaaS service
Suspicious SaaS API call from a Tor exit node
DropBox
External SaaS file-sharing activity
Massive upload to SaaS service
Massive file downloads from SaaS service
Suspicious SaaS API call from a Tor exit node
Duo
Intense SSO failures
SSO Brute Force
A user accessed multiple unusual resources via SSO
Impossible traveler - SSO
SSO Password Spray
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO authentication by a machine account
SSO with abnormal user agent
Suspicious SSO access from ASN
First connection from a country in organization
SSO with new operating system
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
Gcp Audit Log
Suspicious identity downloaded multiple objects from a bucket
An identity performed a suspicious download of multiple cloud storage objects
Multiple cloud snapshots export
Cloud user performed multiple actions that were denied
Storage enumeration activity
Kubernetes enumeration activity
Multi region enumeration activity
Deletion of multiple cloud resources
Cloud infrastructure enumeration activity
Allocation of multiple cloud compute resources
IAM Enumeration sequence
An identity dumped multiple secrets from a project
Multiple failed logins from a single IP
Abnormal Allocation of compute resources in multiple regions
A Kubernetes ephemeral container was created
Unusual resource modification by newly seen IAM user
A Kubernetes Pod was created with a sidecar container
A Kubernetes node service account activity from external IP
A Kubernetes StatefulSet was created
GCP IAM Service Account Key Deletion
Unusual Identity and Access Management (IAM) activity
GCP Virtual Private Cloud (VPC) Network Deletion
GCP Virtual Private Network Route Creation
Suspicious heavy allocation of compute resources - possible mining activity
Kubernetes cluster events deletion
A Kubernetes role binding was created or deleted
A Kubernetes service was created or deleted
A cloud snapshot was created or modified
A Command Line Interface (CLI) command was executed from a GCP serverless compute service
GCP Logging Sink Deletion
A Kubernetes ReplicaSet was created
GCP Firewall Rule creation
A cloud function was created with an unusual runtime
A Kubernetes deployment was created
GCP Logging Sink Modification
GCP VPC Firewall Rule Deletion
Penetration testing tool activity
GCP Service Account creation
Kubernetes network policy modification
A Kubernetes Pod was deleted
Unusual IAM enumeration activity by a non-user Identity
A Kubernetes API operation was successfully invoked by an anonymous user
Cloud identity reached a throttling API rate
GCP Service Account Disable
Cloud compute instance user data script modification
A Kubernetes cluster role binding was created or deleted
A Kubernetes namespace was created or deleted
GCP IAM Role Deletion
Unusual key management activity
Unusual secret management activity
A Kubernetes secret was created or deleted
GCP Virtual Private Network Route Deletion
Unusual cloud identity impersonation
Remote usage of an App engine Service Account token
Cloud storage delete protection disabled
Network sniffing detected in Cloud environment
GCP Storage Bucket deletion
Kubernetes service account activity outside the cluster
A Kubernetes service account has enumerated its permissions
A cloud identity had escalated its permissions
GCP Service Account key creation
Suspicious cloud compute instance ssh keys modification attempt
A Kubernetes dashboard service account was used outside the cluster
GCP Pub/Sub Subscription Deletion
Kubernetes Privileged Pod Creation
GCP Storage Bucket Permissions Modification
Remote usage of VM Service Account token
GCP IAM Custom Role Creation
Cloud storage automatic backup disabled
Kubernetes admission controller activity
An operation was performed by an identity from a domain that was not seen in the organization
Kubernetes pod creation from unknown container image registry
A cloud storage configuration was modified
Cloud compute serial console access
A cloud instance was stopped
A Kubernetes cluster was created or deleted
Unusual cross projects activity
A Kubernetes service account was created or deleted
Cloud impersonation attempt by unusual identity type
GCP Firewall Rule Modification
Cloud Organizational policy was created or modified
Unusual exec into a Kubernetes Pod
Unusual resource modification/creation
A cloud identity invoked IAM related persistence operations
Suspicious API call from a Tor exit node
A Kubernetes ConfigMap was created or deleted
GCP Storage Bucket Configuration Modification
A Kubernetes DaemonSet was created
Kubernetes Pod created with host process ID (PID) namespace
Billing admin role was removed
Kubernetes pod creation with host network
Unusual certificate management activity
A cloud identity executed an API call from an unusual country
GCP Pub/Sub Topic Deletion
GCP Logging Bucket Deletion
A Kubernetes Cronjob was created
Kubernetes Pod Created With Sensitive Volume
Denied API call by a Kubernetes service account
GCP set IAM policy activity
Cloud unusual access key creation
Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
Activity in a dormant region of a cloud project
GCP Service Account deletion
Kubernetes vulnerability scanning tool usage
A cloud identity created or modified a security group
A container registry was created or deleted
A Kubernetes service account executed an unusual API call
Gcp Flow Log
An internal Cloud resource performed port scan on external networks
SSH brute force attempt
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
Gmail Email Log
EMAIL BETA - Email suspicious Moniker link detected
EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat
EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default
EMAIL BETA - Email attachment with multiple extensions
Google Workspace Audit Logs
External SaaS file-sharing activity
Massive upload to SaaS service
Massive file downloads from SaaS service
A Google Workspace user was removed from a group
Gmail routing settings changed
An app was removed from a blocked list in Google Workspace
A Google Workspace identity created, assigned or modified a role
MFA Disabled for Google Workspace
Admin privileges were granted to a Google Workspace user
A Google Workspace service was configured as unrestricted
A third-party application's access to the Google Workspace domain's resources was revoked
A Google Workspace identity used the security investigation tool
Google Workspace third-party application's security settings were changed
Suspicious SaaS API call from a Tor exit node
SaaS suspicious external domain user activity
An app was added to the Google Workspace trusted OAuth apps list
Google Marketplace restrictions were modified
Google Workspace organizational unit was modified
A Google Workspace Role privilege was deleted
An app was added to Google Marketplace
Gmail delegation was turned on for the organization
A GCP service account was delegated domain-wide authority in Google Workspace
A domain was added to the trusted domains list
Data Sharing between GCP and Google Workspace was disabled
A Google Workspace user was added to a group
External Sharing was turned on for Google Drive
A mail forwarding rule was configured in Google Workspace
A Google Workspace identity performed an unusual admin console activity
A third-party application was authorized to access the Google Workspace APIs
User accessed SaaS resource via anonymous link
Google Workspace Authentication
First SSO access from ASN in organization
First SSO access from ASN for user
Suspicious SSO access from ASN
A user logged in at an unusual time via SSO
Health Monitoring Data
Logs were not collected from a data source for an abnormally long time
Error in event forwarding
Correlation rule error
Parsing Rule Error
Collection error
Office 365 Audit
A user uploaded malware to SharePoint or OneDrive
User moved Exchange sent messages to deleted items
Sensitive Exchange mail sent to external users
External SaaS file-sharing activity
Massive upload to SaaS service
Massive file downloads from SaaS service
User accessed multiple O365 AIP sensitive files
Exchange mailbox delegation permissions added
Exchange email-hiding transport rule
SharePoint Site Collection admin group addition
Exchange Safe Attachment policy disabled or removed
Exchange DKIM signing configuration disabled
Penetration testing tool activity attempt
Suspicious SaaS API call from a Tor exit node
SaaS suspicious external domain user activity
Rare DLP rule match by user
Exchange mailbox folder permission modification
Exchange inbox forwarding rule configured
Exchange mailbox audit bypass
DLP sensitive data exposed to external users
Exchange anti-phish policy disabled or removed
Microsoft 365 DLP policy disabled or removed
Exchange user mailbox forwarding
Exchange transport forwarding rule configured
Exchange email-hiding inbox rule
Exchange audit log disabled
Exchange malware filter policy removed
Exchange Safe Link policy disabled or removed
User accessed SaaS resource via anonymous link
Exchange compliance search created
Office 365 Mail
EMAIL BETA - Email suspicious Moniker link detected
EMAIL BETA - Email has a short body or subject and was sent from an external source
EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat
EMAIL BETA - Email containing urgency terms was received from an external domain
EMAIL BETA - URL(s) classified as risky have been detected within Email
EMAIL BETA - Email was received from a newly registered domain
EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
EMAIL BETA - Unpopular domains detected in email URLs for a recipient
EMAIL BETA - Well-known brand impersonation within an email's from address domain
EMAIL BETA - Email Punycode characters in URL
EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default
EMAIL BETA - Email containing a link with an IP address convention was detected
EMAIL BETA - Email contains URL(s) classified as inappropriate
EMAIL BETA - Email attachment with multiple extensions
EMAIL BETA - Email received from an unknown sender using a public provider email address
EMAIL BETA - Email received from an unknown sender using a disposable email address
EMAIL BETA - Email was received from an unknown sender address
EMAIL BETA - Email containing a redirected link
EMAIL BETA - Email with URL shortener detected
EMAIL BETA - External email display name impersonation of internal personnel
EMAIL BETA - An email was received from a domain classified as risky
EMAIL BETA - Unpopular domain(s) detected in an email's URL(s)
EMAIL BETA - Suspicious Unicode character detected in email
EMAIL BETA - Unpopular URL domain(s) in your organization detected in email
EMAIL BETA - Usage of homograph characters detected in an email's from header
EMAIL BETA - Email attachment with a potentially malicious file extension
EMAIL BETA - Unpopular URL(s) detected in email
EMAIL BETA - Email containing financial content was received from an external domain
EMAIL BETA - Email contains URL(s) classified as malicious
EMAIL BETA - Email message contains text hiding attributes
EMAIL BETA - Usage of homograph characters detected in an email
EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email
EMAIL BETA - Email was sent from a domain classified as inappropriate
EMAIL BETA - Email attachment(s) with potentially malicious MIME type
EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation
EMAIL BETA - An email was sent from a malicious domain
EMAIL BETA - Unusual hostname for the sending mail server in the email headers
Okta
Intense SSO failures
SSO Brute Force
A user rejected an SSO request from an unusual country
A user accessed multiple unusual resources via SSO
Multiple SSO MFA attempts were rejected by a user
Impossible traveler - SSO
SSO Password Spray
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO with abnormal operating system
SSO authentication by a machine account
Suspicious SSO authentication
SSO with abnormal user agent
Suspicious SSO access from ASN
First connection from a country in organization
SSO with new operating system
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
SSO authentication attempt by a honey user
Okta Audit Log
Okta Reported Threat Detected
Okta device assignment
A user observed and reported unusual activity in Okta
Okta account unlock
Okta account reset password attempt
Okta Reported Attack Suspected
User added a new device to Okta Verify instance
Okta API Token Created
A user attempted to bypass Okta MFA
Okta User Session Impersonation
Okta admin privilege assignment
A user modified an Okta policy rule
A user accessed Okta's admin application
Potential Okta access limit breach
Okta account unlock by admin
A user modified an Okta network zone
OneLogin
Intense SSO failures
SSO Brute Force
A user accessed multiple unusual resources via SSO
Impossible traveler - SSO
SSO Password Spray
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO authentication by a machine account
Suspicious SSO access from ASN
First connection from a country in organization
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
SSO authentication attempt by a honey user
Palo Alto Networks Global Protect
VPN login Brute-Force attempt
Impossible traveler - VPN
A user connected to a VPN from a new country
First VPN access from ASN in organization
A Successful VPN connection from TOR
VPN access with an abnormal operating system
First VPN access from ASN for user
VPN login with a machine account
VPN login by a service account
First VPN access attempt from a country in organization
VPN login attempt by a honey user
VPN login by a dormant user
A disabled user attempted to log in to a VPN
A user logged in at an unusual time via VPN
Palo Alto Networks Platform Logs
New Administrative Behavior
Multiple Weakly-Encrypted Kerberos Tickets Received
Kerberos Pre-Auth Failures by Host
Large Upload (SMTP)
Upload pattern that resembles Peer to Peer traffic
Failed Connections
Port Scan
A user accessed multiple time-consuming websites
Large Upload (HTTPS)
Random-Looking Domain Names
Failed DNS
Subdomain Fuzzing
Suspicious DNS traffic
Kerberos User Enumeration
NTLM Password Spray
Large Upload (FTP)
NTLM Hash Harvesting
Download pattern that resembles Peer to Peer traffic
Uncommon WPAD queries
Rare access to known advertising domains
Kerberos Pre-Auth Failures by User and Host
Massive upload to a rare storage or mail domain
HTTP with suspicious characteristics
Multiple Suspicious FTP Login Attempts
Increase in Job-Related Site Visits
Rare LDAP enumeration
NTLM Relay
Large Upload (Generic)
SSH brute force attempt
SSH brute force attempt
Spam Bot Traffic
DNS Tunneling
Abnormal network communication through TOR using an uncommon port
FTP Connection Using an Anonymous Login or Default Credentials
A user accessed an uncommon AppID
Weakly-Encrypted Kerberos TGT Response
Abnormal Communication to a Rare Domain
A Possible crypto miner was detected on a host
Rare SMTP/S Session
Suspicious NTLM authentication with machine account
A Torrent client was detected on a host
Rare Scheduled Task RPC activity
Rare MS-Update Server was detected
Abnormal Recurring Communications to a Rare Domain
Unique client computer model was detected via MS-Update protocol
Failed Login For a Long Username With Special Characters
Weakly-Encrypted Kerberos Ticket Requested
Rare file transfer over SMB protocol
Recurring access to rare IP
Rare AppID usage to a rare destination
A rare FTP user has been detected on an existing FTP server
Rare NTLM Usage by User
Suspicious failed HTTP request - potential Spring4Shell exploit
Possible path traversal via HTTP request
Rare NTLM Access By User To Host
Rare RDP session to a remote host
Rare Windows Remote Management (WinRM) HTTP Activity
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
Unusual SSH activity that resembles SSH proxy
Suspicious SSH Downgrade
Failed Login For Locked-Out Account
Suspicious ICMP packet
Uncommon SSH session was established
Possible IPFS traffic was detected
Bronze-Bit exploit
Suspicious SMB connection from domain controller
Possible Kerberoasting without SPNs
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
Recurring rare domain access to dynamic DNS domain
New FTP Server
Rare SMB session to a remote host
Possible use of IPFS was detected
Authentication Attempt From a Dormant Account
Multiple uncommon SSH Servers with the same Server host key
Palo Alto Networks Url Logs
Uncommon network tunnel creation
PowerShell Initiates a Network Connection to GitHub
Non-browser access to a pastebin-like site
A non-browser process accessed a website UI
Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
PingOne
Intense SSO failures
SSO Brute Force
A user accessed multiple unusual resources via SSO
Impossible traveler - SSO
SSO Password Spray
First SSO access from ASN in organization
A user connected from a new country
A successful SSO sign-in from TOR
First SSO access from ASN for user
A disabled user attempted to authenticate via SSO
User attempted to connect from a suspicious country
SSO authentication by a machine account
SSO with abnormal user agent
Suspicious SSO access from ASN
First connection from a country in organization
SSO authentication by a service account
A user logged in at an unusual time via SSO
First SSO Resource Access in the Organization
SSO authentication attempt by a honey user
Third-Party Firewalls
New Administrative Behavior
Large Upload (SMTP)
Upload pattern that resembles Peer to Peer traffic
Failed Connections
Port Scan
Large Upload (HTTPS)
SSH brute force attempt
Spam Bot Traffic
Abnormal Communication to a Rare Domain
Rare SMTP/S Session
A Torrent client was detected on a host
Abnormal Recurring Communications to a Rare Domain
Recurring access to rare IP
Rare AppID usage to a rare destination
Rare RDP session to a remote host
Rare Windows Remote Management (WinRM) HTTP Activity
Possible DCShadow attempt
Unusual SSH activity that resembles SSH proxy
Uncommon SSH session was established
Suspicious SMB connection from domain controller
Recurring rare domain access to dynamic DNS domain
New FTP Server
Rare SMB session to a remote host
Third-Party VPNs
VPN login Brute-Force attempt
Impossible traveler - VPN
A user connected to a VPN from a new country
First VPN access from ASN in organization
A Successful VPN connection from TOR
VPN access with an abnormal operating system
First VPN access from ASN for user
VPN login with a machine account
VPN login by a service account
First VPN access attempt from a country in organization
VPN login attempt by a honey user
VPN login by a dormant user
A disabled user attempted to log in to a VPN
A user logged in at an unusual time via VPN
Windows Event Collector
A new machine attempted Kerberos delegation
A user requested multiple service tickets
A user sent multiple TGT requests to irregular service
Multiple suspicious user accounts were created
Multiple user accounts were deleted
Short-lived user account
A user received multiple weakly encrypted service tickets
Multiple TGT requests for users without Kerberos pre-authentication
User added to a group and removed
A user printed an unusual number of files
Excessive user account lockouts
A user certificate was issued with a mismatch
A machine certificate was issued with a mismatch
Service ticket request with a spoofed sAMAccountName
Member added to a Windows local security group
A user account was modified to password never expires
PowerShell used to export mailbox contents
Sensitive account password reset attempt
Mailbox Client Access Setting (CAS) changed
Suspicious sAMAccountName change
Masquerading as a default local account
Rare machine account creation
A computer account was promoted to DC
Security tools detection attempt
Suspicious modification of the AdminSDHolder's ACL
User account delegation change
VM Detection attempt
Suspicious hidden user created
A user changed the Windows system time
A user enabled a default local account
SPNs cleared from a machine account
Administrator groups enumerated via LDAP
TGT request with a spoofed sAMAccountName - Event log
Possible Kerberos relay attack
Unusual user account enablement
Machine account was added to a domain admins group
PowerShell used to remove mailbox export request logs
Local user account creation
A user was added to a Windows security group
Unusual user account unlock
User added SID History to an account
Suspicious domain user account creation
XDR Agent
New Administrative Behavior
Interactive local account enumeration
Internal Login Password Spray
Abnormal ICMP echo (PING) to multiple hosts
Possible TGT reuse from different hosts (pass the ticket)
Possible brute force on sudo user
Sudoedit Brute force attempt
Multiple Weakly-Encrypted Kerberos Tickets Received
Kerberos Pre-Auth Failures by Host
Suspicious container reconnaissance activity in a Kubernetes pod
Large Upload (SMTP)
Upload pattern that resembles Peer to Peer traffic
Suspicious ICMP traffic that resembles smurf attack
Kubernetes environment enumeration activity
Remote account enumeration
Failed Connections
Port Scan
SSH authentication brute force attempts
Multiple discovery commands
Large Upload (HTTPS)
Abnormal SMB activity to multiple hosts
Random-Looking Domain Names
Failed DNS
Subdomain Fuzzing
Suspicious DNS traffic
Abnormal RDP connections to multiple hosts
Kerberos User Enumeration
Abnormal sensitive RPC traffic to multiple hosts
External Login Password Spray
NTLM Brute Force on an Administrator Account
A user authenticated with weak NTLM to multiple hosts
New Shared User Account
Possible brute force or configuration change attempt on cytool
NTLM Password Spray
Account probing
Brute-force attempt on a local account
Large Upload (FTP)
Multiple discovery commands on a Linux host by the same process
NTLM Hash Harvesting
Multiple discovery commands on a Windows host by the same process
Download pattern that resembles Peer to Peer traffic
Uncommon WPAD queries
A user logged on to multiple workstations via Schannel
Rare access to known advertising domains
Kerberos Pre-Auth Failures by User and Host
NTLM Brute Force on a Service Account
Possible Brute-Force attempt
NTLM Brute Force
Multiple Rare LOLBIN Process Executions by User
Massive upload to a rare storage or mail domain
Multiple discovery-like commands
HTTP with suspicious characteristics
NTLM Relay
Multiple users authenticated with weak NTLM to a host
Large Upload (Generic)
Possible external RDP Brute-Force
Multiple Rare Process Executions in Organization
SSH brute force attempt
Spam Bot Traffic
DNS Tunneling
Abnormal network communication through TOR using an uncommon port
AppleScript executed a shell script
Mshta.exe launched with suspicious arguments
Suspicious process execution from tmp folder
Vulnerable driver loaded
Rare process spawned by srvany.exe
A user accessed an uncommon AppID
Possible DLL Hijack into a Microsoft process
Suspicious Certutil AD CS contact
Weakly-Encrypted Kerberos TGT Response
Suspicious time provider registered
Possible Microsoft process masquerading
Indicator blocking
Hidden Attribute was added to a file using attrib.exe
Suspicious RunOnce Parent Process
Unusual Azure AD sync module load
Procdump executed from an atypical directory
Uncommon RDP connection
Keylogging using system commands
Abnormal Communication to a Rare Domain
Ping to localhost from an uncommon, unsigned parent process
Commonly abused process launched as a system service
Suspicious process execution in a privileged container
Execution of dllhost.exe with an empty command line
A contained executable was executed by an unusual process
SMB Traffic from Non-Standard Process
Uncommon DotNet module load relationship
Office process creates a scheduled task via file access
A Possible crypto miner was detected on a host
Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary
Suspicious docker image download from an unusual repository
Wscript/Cscript loads .NET DLLs
Execution of an uncommon process at an early startup stage
Possible code downloading from a remote host by Regsvr32
Unsigned process creates a scheduled task via file access
Possible compromised machine account
A LOLBIN was copied to a different location
Kubernetes version disclosure
AppleScript process executed with a rare command line
Mimikatz command-line arguments
Discovery of host users via WMIC
Suspicious data encryption
Uncommon remote scheduled task creation
Rundll32.exe running with no command-line arguments
An uncommon service was started
Cached credentials discovery with cmdkey
Execution of an uncommon process with a local/domain user SID at an early startup stage
SUID/GUID permission discovery
A process was executed with a command line obfuscated by Unicode character substitution
System shutdown or reboot
Abnormal Communication to a Rare IP
Certutil pfx parsing
Suspicious sshpass command execution
Possible RDP session hijacking using tscon.exe
Windows Installer exploitation for local privilege escalation
Rare SMTP/S Session
Signed process performed an unpopular DLL injection
A suspicious process enrolled for a certificate
Possible new DHCP server
Uncommon Managed Object Format (MOF) compiler usage
Msiexec execution of an executable from an uncommon remote location
PowerShell suspicious flags
Suspicious NTLM authentication with machine account
A disabled user attempted to log in
Office process spawned with suspicious command-line arguments
Uncommon net group or localgroup execution
Masquerading as the Linux crond process
A Torrent client was detected on a host
Linux process execution with a rare GitHub URL
Suspicious usage of File Server Remote VSS Protocol (FSRVP)
Suspicious container runtime connection from within a Kubernetes Pod
Rare Scheduled Task RPC activity
Rare SSH Session
Suspicious PowerShell Enumeration of Running Processes
Unsigned process injecting into a Windows system binary with no command line
A Successful login from TOR
Bitsadmin.exe persistence using command-line callback
MpCmdRun.exe was used to download files into the system
Delayed Deletion of Files
PowerShell runs suspicious base64-encoded commands
Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
Unusual AWS credentials creation
Rare LOLBIN Process Execution by User
Abnormal Recurring Communications to a Rare Domain
Manipulation of netsh helper DLLs Registry keys
Suspicious Process Spawned by Adobe Reader
Command running with COMSPEC in the command line argument
Failed Login For a Long Username With Special Characters
Possible network service discovery via command-line tool
Autorun.inf created in root C drive
Windows LOLBIN executable connected to a rare external host
A process connected to a rare external host
Interactive login by a machine account
Suspicious PowerShell Command Line
Rare Unix process divided files by size
Possible Email collection using Outlook RPC
The CA policy EditFlags was queried
LOLBIN process executed with a high integrity level
Uncommon IP Configuration Listing via ipconfig.exe
Kerberos Traffic from Non-Standard Process
Uncommon driver loaded
Rundll32.exe spawns conhost.exe
Remote code execution into Kubernetes Pod
Remote service start from an uncommon source
Unusual AWS user added to group
Interactive at.exe privilege escalation method
Suspicious Process Spawned by wininit.exe
Registration of Uncommon .NET Services and/or Assemblies
A service was disabled
Microsoft Office process spawns a commonly abused process
Attempt to execute a command on a remote host using PsExec.exe
Modification of PAM
Suspicious process loads a known PowerShell module
A contained executable from a mounted share initiated a suspicious outbound network connection
New addition to Windows Defender exclusion list
A user logged in from an abnormal country or ASN
Uncommon remote service start via sc.exe
Login attempt by a honey user
Possible collection of screen captures with Windows Problem Steps Recorder
Rare process executed by an AppleScript
Encoded information using Windows certificate management tool
Commonly abused AutoIT script connects to an external domain
Suspicious .NET process loads an MSBuild DLL
Globally uncommon IP address by a common process (sha256)
Remote DCOM command execution
Extracting credentials from Unix files
Unusual process accessed the PowerShell history file
Weakly-Encrypted Kerberos Ticket Requested
Recurring rare domain access from an unsigned process
Compressing data using python
Command execution via wmiexec
Setuid and Setgid file bit manipulation
Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
Possible DCSync from a non domain controller
Uncommon remote monitoring and management tool
Abnormal process connection to default Meterpreter port
Executable moved to Windows system folder
Scrcons.exe Rare Child Process
Rare process execution by user
Screensaver process executed from Users or temporary folder
TGT request with a spoofed sAMAccountName - Network
Remote WMI process execution
Adding execution privileges
Rare file transfer over SMB protocol
Microsoft Office injects code into a process
Login by a dormant user
Possible Search For Password Files
Stored credentials exported using credwiz.exe
PsExec was executed with a suspicious command line
Recurring access to rare IP
Suspicious authentication package registered
Unusual DB process spawning a shell
Suspicious certutil command line
Memory dumping with comsvcs.dll
File transfer from unusual IP using known tools
Unpopular rsync process execution
Possible DLL Side-Loading
Rare process execution in organization
Suspicious systemd timer activity
Script file added to startup-related Registry keys
Execution of the Hydra Linux password brute-force tool
Remote service command execution from an uncommon source
Rare WinRM Session
Copy a user's GnuPG directory with rsync
Unprivileged process opened a registry hive
WmiPrvSe.exe Rare Child Command Line
Rare AppID usage to a rare destination
Possible binary padding using dd
Uncommon ARP cache listing via arp.exe
Interactive login by a service account
The Linux system firewall was disabled
Suspicious module load using direct syscall
Rare security product signed executable executed in the network
Phantom DLL Loading
Interactive login from a shared user account
Permission Groups discovery commands
Uncommon execution of ODBCConf
Reading bash command history file
Rundll32.exe executes a rare unsigned module
Uncommon kernel module load
Linux network share discovery
Unicode RTL Override Character
Uncommon Service Create/Config
Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
Suspicious disablement of the Windows Firewall
Suspicious SearchProtocolHost.exe parent process
Rare NTLM Usage by User
Suspicious failed HTTP request - potential Spring4Shell exploit
MSI accessed a web page running a server-side script
Python HTTP server started
Kubernetes secret enumeration activity
A TCP stream was created directly in a shell
Unusual Kubernetes API server communication from a pod
Rare Remote Service (SVCCTL) RPC activity
Possible path traversal via HTTP request
Possible Kerberos relay attack
Unusual compressed file password protection
Kubernetes vulnerability scanner activity
Kubernetes nsenter container escape
Globally uncommon IP address connection from a signed process
Injection into rundll32.exe
Scripting engine connected to a rare external host
Uncommon cloud CLI tool usage
System information discovery via psinfo.exe
Unusual Lolbins Process Spawned by InstallUtil.exe
Rare NTLM Access By User To Host
Rare DCOM RPC activity
Globally uncommon image load from a signed process
Local account discovery
Suspicious runonce.exe parent process
Iptables configuration command was executed
Possible network sniffing attempt via tcpdump or tshark
Globally uncommon root-domain port combination by a common process (sha256)
Suspicious setspn.exe execution
Rare RDP session to a remote host
Rare Windows Remote Management (WinRM) HTTP Activity
Suspicious process accessed a site masquerading as Google
Possible DCShadow attempt
Service execution via sc.exe
Unusual SSH activity that resembles SSH proxy
Remote PsExec-like command execution
Fodhelper.exe UAC bypass
Unsigned and unpopular process performed an injection
Indirect command execution using the Program Compatibility Assistant
Netcat makes or gets connections
Wbadmin deleted files in quiet mode
Rare signature signed executable executed in the network
A compressed file was exfiltrated over SSH
Abnormal User Login to Domain Controller
Possible data obfuscation
Globally uncommon injection from a signed process
Possible DLL Search Order Hijacking
Uncommon communication to an instant messaging server
Run downloaded script using pipe
Failed Login For Locked-Out Account
Globally uncommon root-domain port combination from a signed process
Unsigned and unpopular process performed a DLL injection
Svchost.exe loads a rare unsigned module
Globally uncommon high entropy process was executed
Unusual Kubernetes dashboard communication from a pod
Globally uncommon high entropy module was loaded
Suspicious curl user agent
Suspicious container orchestration job
Installation of a new System-V service
Suspicious ICMP packet
Globally uncommon root domain from a signed process
Reverse SSH tunnel to external domain/ip
Wsmprovhost.exe Rare Child Process
Tampering with Internet Explorer Protected Mode configuration
Uncommon SSH session was established
Uncommon msiexec execution of an arbitrary file from a remote location
Uncommon routing table listing via route.exe
Download a script using the python requests module
Possible IPFS traffic was detected
Signed process performed an unpopular injection
Suspicious process execution by scheduled task
Windows Event Log was cleared using wevtutil.exe
Uncommon user management via net.exe
Bronze-Bit exploit
Suspicious SMB connection from domain controller
Uncommon net localgroup execution
VM Detection attempt on Linux
Microsoft Office Process Spawning a Suspicious One-Liner
Possible Kerberoasting without SPNs
Globally uncommon process execution from a signed process
LDAP traffic from non-standard process
Suspicious proxy environment variable setting
A rare local administrator login
Copy a process memory file
Suspicious process executed with a high integrity level
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
RDP Connection to localhost
Command execution in a Kubernetes pod
Suspicious External RDP Login
Recurring rare domain access to dynamic DNS domain
LOLBAS executable injects into another process
Execution of an uncommon process at an early startup stage by Windows system binary
Contained process execution with a rare GitHub URL
WebDAV drive mounted from net.exe over HTTPS
Remote command execution via wmic.exe
Rare communication over email ports to external email server by unsigned process
New FTP Server
Suspicious print processor registered
Execution of renamed lolbin
Possible Pass-the-Hash
Uncommon local scheduled task creation via schtasks.exe
Cloud Unusual Instance Metadata Service (IMDS) access
Rare SMB session to a remote host
Possible use of IPFS was detected
A browser was opened in private mode
Authentication Attempt From a Dormant Account
Unusual weak authentication by user
Multiple uncommon SSH Servers with the same Server host key
Possible malicious .NET compilation started by a commonly abused process
XDR Agent with eXtended Threat Hunting (XTH)
Possible data exfiltration over a USB storage device
Massive file activity abnormal to process
Possible LDAP enumeration by unsigned process
A user established an SMB connection to multiple hosts
User and Group Enumeration via SAMR
A new machine attempted Kerberos delegation
A user requested multiple service tickets
A user sent multiple TGT requests to irregular service
Multiple suspicious user accounts were created
User collected remote shared files in an archive
Suspicious reconnaissance using LDAP
A contained process attempted to escape using the 'notify on release' feature
A user accessed an abnormal number of files on a remote shared folder
A user accessed an abnormal number of remote shared folders
Suspicious access to cloud credential files
A user connected a new USB storage device to multiple hosts
Multiple user accounts were deleted
Short-lived user account
A user took numerous screenshots
A user performed suspiciously massive file activity
Outlook files accessed by an unsigned process
A user received multiple weakly encrypted service tickets
Possible internal data exfiltration over a USB storage device
A user executed multiple LDAP enumeration queries
Multiple TGT requests for users without Kerberos pre-authentication
User added to a group and removed
A user printed an unusual number of files
Massive file compression by user
Excessive user account lockouts
Unusual ADConnect database file access
Uncommon GetClipboardData API function invocation of a possible information stealer
A process queried the ADFS database decryption key via LDAP
Windows event logs were cleared with PowerShell
Uncommon AT task-job creation by user
Uncommon PowerShell commands used to create or alter scheduled task parameters
Unusual process accessed a web browser history file
Browser Extension Installed
A user certificate was issued with a mismatch
Unusual Encrypting File System Remote call (EFSRPC) to domain controller
Suspicious disablement of the Windows Firewall using PowerShell commands
Scheduled Task hidden by registry modification
User set insecure CA registry setting for global SANs
A machine certificate was issued with a mismatch
Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
Office process accessed an unusual .LNK file
A user connected a USB storage device for the first time
Microsoft Office adds a value to autostart Registry key
Possible LDAP Enumeration Tool Usage
SecureBoot was disabled
Service ticket request with a spoofed sAMAccountName
Suspicious DotNet log file created
User discovery via WMI query execution
Suspicious PowerSploit's recon module (PowerView) net function was executed
A user added a Windows firewall rule
Unusual Kubernetes service account file read
Uncommon SetWindowsHookEx API invocation of a possible keylogger
Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
Member added to a Windows local security group
A suspicious executable with multiple file extensions was created
A user account was modified to password never expires
Potential SCCM credential harvesting using WMI detected
Unusual process accessed a messaging app's files
Possible Persistence via group policy Registry keys
PowerShell used to export mailbox contents
Unusual use of a 'SysInternals' tool
Possible Distributed File System Namespace Management (DFSNM) abuse
Access to Kubernetes configuration file
Sensitive account password reset attempt
Uncommon Security Support Provider (SSP) registered via a registry key
Mailbox Client Access Setting (CAS) changed
Unusual process access to ld.so.preload file
A process modified an SSH authorized_keys file
Browser bookmark files accessed by a rare non-browser process
Suspicious sAMAccountName change
A rare file path was added to the AppInit_DLLs registry value
Unusual access to the AD Sync credential files
Executable or Script file written by a web server process
Sensitive browser credential files accessed by a rare non browser process
PowerShell pfx certificate extraction
System profiling WMI query execution
Possible SPN enumeration
Unusual process accessed FTP Client credentials
Suspicious AMSI decode attempt
A user created a pfx file for the first time
Suspicious active setup registered
LDAP search query from an unpopular and unsigned process
Unusual access to the Windows Internal Database on an ADFS server
LSASS dump file written to disk
Commonly abused AutoIT script drops an executable file to disk
Masquerading as a default local account
Rare machine account creation
An unusual archive file creation by a user
A computer account was promoted to DC
A WMI subscriber was created
Security tools detection attempt
Suspicious modification of the AdminSDHolder's ACL
Known service display name with uncommon image-path
Change of sudo caching configuration
User account delegation change
Tampering with the Windows User Account Controls (UAC) configuration
VM Detection attempt
Elevation to SYSTEM via services
Suspicious hidden user created
Creation or modification of the default command executed when opening an application
Suspicious process modified RC script file
Possible webshell file written by a web server process
A user queried AD CS objects via LDAP
Unusual process accessed web browser cookies
Discovery of accounts with pre-authentication disabled via LDAP
A user changed the Windows system time
DSC (Desired State Configuration) lateral movement using PowerShell
Suspicious Udev driver rule execution manipulation
Rare process accessed a Keychain file
Uncommon browser extension loaded
An uncommon executable was remotely written over SMB to an uncommon destination
A user enabled a default local account
SPNs cleared from a machine account
Administrator groups enumerated via LDAP
Uncommon access to Microsoft Teams credential files
Linux system firewall was modified
Uncommon creation or access operation of sensitive shadow copy
TGT request with a spoofed sAMAccountName - Event log
Image file execution options (IFEO) registry key set
An uncommon file added to startup-related Registry keys
Unusual user account enablement
Suspicious access to shadow file
Machine account was added to a domain admins group
Rare service DLL was added to the registry
Executable created to disk by lsass.exe
Rare scheduled task created
A suspicious direct syscall was executed
PowerShell used to remove mailbox export request logs
LOLBIN created a PSScriptPolicyTest PowerShell script file
Local user account creation
Unusual process accessed a macOS notes DB file
An unpopular process accessed the microphone on the host
Possible GPO Enumeration
Known service name with an uncommon image-path
A user connected a new USB storage device to a host
Modification of NTLM restrictions in the Registry
Discovery of misconfigured certificate templates using LDAP
Unusual process accessed web browser credentials
A suspicious process queried AD CS objects via LDAP
Space after filename
A user was added to a Windows security group
Unusual user account unlock
A compiled HTML help file wrote a script file to the disk
A remote service was created via RPC over SMB
A browser extension was installed or loaded in an uncommon way
An uncommon file was created in the startup folder
Suspicious LDAP search query executed
NTDS.dit file written by an uncommon executable
RDP connections enabled remotely via Registry
User added SID History to an account
New process created via a WMI call
Suspicious process accessed certificate files
Suspicious Print System Remote Protocol usage by a process
Suspicious domain user account creation
Possible use of a networking driver for network sniffing
Suspicious Kubernetes pod token access
A user created an abnormal password-protected archive
Unusual Netsh PortProxy rule
Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
Uncommon jsp file write by a Java process
Unusual process accessed a crypto wallet's files

Back to home page