Cortex XDR Analytics Alert Reference - Analytics Alert Reference

Cortex XDR Analytics Alert Reference
Required Data Sources
Palo Alto Networks Platform Logs, XDR Agent
NTLM Password Spray
Rare LDAP enumeration
Upload pattern that resembles Peer to Peer traffic
DNS Tunneling
Random-Looking Domain Names
NTLM Relay
Large Upload (FTP)
NTLM Hash Harvesting
Suspicious ICMP traffic that resembles smurf attack
Suspicious DNS traffic
Spam Bot Traffic
Large Upload (SMTP)
Large Upload (HTTPS)
Kerberos Pre-Auth Failures by Host
Kerberos User Enumeration
Large Upload (Generic)
Kerberos Pre-Auth Failures by User and Host
Abnormal sensitive RPC traffic to multiple hosts
Failed DNS
Multiple Weakly-Encrypted Kerberos Tickets Received
Possible DCShadow attempt
Rare NTLM Access By User To Host
Recurring rare domain access to dynamic DNS domain
Rare NTLM Usage by User
Network traffic to a crypto miner related domain detected
Failed Login For a Long Username With Special Characters
Possible Kerberoasting without SPNs
Bronze-Bit exploit
Abnormal network communication through TOR using an uncommon port
Weakly-Encrypted Kerberos Ticket Requested
Uncommon SSH session was established
Possible use of IPFS was detected
Suspicious failed HTTP request - potential Spring4Shell exploit
Authentication Attempt From a Dormant Account
Rare AppID usage to a rare destination
Possible IPFS traffic was detected
A Possible crypto miner was detected on a host
Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
Suspicious ICMP packet
Failed Login For Locked-Out Account
XDR Agent
Possible brute force on sudo user
NTLM Brute Force on a Service Account
Multiple discovery commands on a Linux host by the same process
Multiple Rare LOLBIN Process Executions by User
NTLM Brute Force
SSH authentication brute force attempts
Kubernetes environment enumeration activity
Sudoedit Brute force attempt
New Administrative Behavior
TGT reuse from different hosts (pass the ticket)
Multiple discovery commands
Port Scan
New Shared User Account
Suspicious container reconnaissance activity in a Kubernetes pod
Failed Connections
Possible brute force or configuration change attempt on cytool
Possible external RDP Brute-Force
NTLM Brute Force on an Administrator Account
Login Password Spray
Multiple Rare Process Executions in Organization
Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
Injection into rundll32.exe
Uncommon msiexec execution of an arbitrary file from a remote location
Wsmprovhost.exe Rare Child Process
Suspicious process accessed a site masquerading as Google
Rare signature signed executable executed in the network
Installation of a new System-V service
Suspicious docker image download from an unusual repository
Keylogging using system commands
Phantom DLL Loading
Possible Email collection using Outlook RPC
Suspicious PowerShell Enumeration of Running Processes
Iptables configuration command was executed
Kerberos Traffic from Non-Standard Process
Globally uncommon root-domain port combination from a signed process
Suspicious RunOnce Parent Process
Unusual Kubernetes dashboard communication from a pod
Suspicious print processor registered
Possible network sniffing attempt via tcpdump or tshark
Suspicious data encryption
Unusual AWS credentials creation
Registration of Uncommon .NET Services and/or Assemblies
WebDAV drive mounted from net.exe over HTTPS
Wscript/Cscript loads .NET DLLs
Unusual AWS user added to group
Encoded information using Windows certificate management tool
Login by a dormant user
Bitsadmin.exe persistence using command-line callback
Uncommon IP Configuration Listing via ipconfig.exe
Uncommon ARP cache listing via arp.exe
Possible data obfuscation
Globally uncommon injection from a signed process
Masquerading as the Linux crond process
LOLBIN process executed with a high integrity level
File transfer from unusual IP using known tools
Windows Installer exploitation for local privilege escalation
Compressing data using python
Uncommon DotNet module load relationship
Unicode RTL Override Character
Suspicious authentication package registered
Conhost.exe spawned a suspicious child process
Setuid and Setgid file bit manipulation
Possible binary padding using dd
Uncommon net localgroup execution
Possible collection of screen captures with Windows Problem Steps Recorder
Windows LOLBIN executable connected to a rare external host
Uncommon kernel module load
Microsoft Office injects code into a process
Possible new DHCP server
Rare Unix process divided files by size
Indirect command execution using the Program Compatibility Assistant
Signed process performed an unpopular injection
Office process creates a scheduled task via file access
Suspicious PowerShell Command Line
Suspicious proxy environment variable setting
Mshta.exe launched with suspicious arguments
Execution of renamed lolbin
Suspicious process execution in a privileged container
VM Detection attempt on Linux
System shutdown or reboot
Rare process execution by user
Suspicious certutil command line
Possible RDP session hijacking using tscon.exe
Unusual compressed file password protection
Autorun.inf created in root C drive
Remote DCOM command execution
Unpopular rsync process execution
Download a script using the python requests module
Unusual Kubernetes API server communication from a pod
Suspicious container orchestration job
Uncommon local scheduled task creation via schtasks.exe
Suspicious SearchProtocolHost.exe parent process
Linux system firewall was disabled
Possible Search For Password Files
Unprivileged process opened a registry hive
Suspicious process executed with a high integrity level
Kubernetes version disclosure
Manipulation of netsh helper DLLs Registry keys
Rare WinRM Session
Suspicious time provider registered
Remote WMI process execution
Script file added to startup-related Registry keys
WmiPrvSe.exe Rare Child Command Line
Possible Microsoft DLL Hijack into a Microsoft process
Remote code execution into Kubernetes Pod
Rare SMTP/S Session
Rare communication over email ports to external email server by unsigned process
SUID/GUID permission discovery
Hidden Attribute was added to a file using attrib.exe
Rundll32.exe running with no command-line arguments
Delayed Deletion of Files
Suspicious User Login to Domain Controller
Attempt to execute a command on a remote host using PsExec.exe
Unusual Azure AD sync module load
Suspicious runonce.exe parent process
RDP Connection to localhost
Office process spawned with suspicious command-line arguments
Image File Execution Options Registry key injection by unsigned process
A suspicious process enrolled for a certificate
Process execution with a suspicious command line indicative of the Spring4Shell exploit
Permission Groups discovery commands
Suspicious module load using direct syscall
Suspicious systemd timer activity
Signed process performed an unpopular DLL injection
Uncommon remote service start via sc.exe
Modification of PAM
Service execution via sc.exe
New addition to Windows Defender exclusion list
Extracting credentials from Unix files
Reading bash command history file
Globally uncommon image load from a signed process
MpCmdRun.exe was used to download files into the system
PowerShell suspicious flags
Uncommon routing table listing via route.exe
Suspicious Certutil AD CS contact
Screensaver process executed from Users or temporary folder
A contained executable was executed by an unusual process
Adding execution privileges
A process was executed with a command line obfuscated by Unicode character substitution
Local account discovery
PsExec was executed with a suspicious command line
Uncommon Managed Object Format (MOF) compiler usage
Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
Remote command execution via wmic.exe
Scrcons.exe Rare Child Process
A disabled user attempted to log in
Suspicious External RDP Login
MSI accessed a web page running a server-side script
Possible DCSync from a non domain controller
The CA policy EditFlags was queried
Python HTTP server started
A LOLBIN was copied to a different location
An uncommon service was started
Commonly abused process launched as a system service
Vulnerable driver loaded
Uncommon RDP connection
Possible compromised machine account
Remote PsExec-like command execution
Suspicious sshpass command execution
Rundll32.exe spawns conhost.exe
Executable moved to Windows system folder
Microsoft Office process spawns a commonly abused process
Unusual Lolbins Process Spawned by InstallUtil.exe
A process connected to a rare external host
Unusual process accessed the PowerShell history file
Procdump executed from an atypical directory
Interactive at.exe privilege escalation method
Unsigned process creates a scheduled task via file access
Contained process execution with a rare GitHub URL
Tampering with Internet Explorer Protected Mode configuration
Uncommon net group or localgroup execution
Stored credentials exported using credwiz.exe
Commonly abused AutoIT script connects to an external domain
Rare SSH Session
Suspicious process execution from tmp folder
A browser was opened in private mode
Memory dumping with comsvcs.dll
Uncommon user management via net.exe
Possible Cloud Instance Metadata Service (IMDS) Abuse
Microsoft Office Process Spawning a Suspicious One-Liner
Cached credentials discovery with cmdkey
Reverse SSH tunnel to external domain/ip
Suspicious container runtime connection from within a Kubernetes Pod
Suspicious process loads a known PowerShell module
Unsigned and unpopular process performed an injection
Suspicious usage of File Server Remote VSS Protocol (FSRVP)
Suspicious disablement of the Windows Firewall
System information discovery via psinfo.exe
PowerShell runs suspicious base64-encoded commands
LDAP Traffic from Non-Standard Process
Possible network service discovery via command-line tool
Discovery of host users via WMIC
Msiexec execution of an executable from an uncommon remote location
Execution of dllhost.exe with an empty command line
Abnormal process connection to default Meterpreter port
Suspicious curl user agent
Rare process execution in organization
Kubernetes nsenter container escape
Suspicious process execution by scheduled task
Wbadmin deleted files in quiet mode
Rare LOLBIN Process Execution by User
Unsigned and unpopular process performed a DLL injection
Remote service start from an uncommon source
Possible Microsoft process masquerading
SMB Traffic from Non-Standard Process
Suspicious .NET process loads an MSBuild DLL
Recurring rare domain access from an unsigned process
Suspicious Process Spawned by Adobe Reader
Globally uncommon IP address connection from a signed process
Execution of the Hydra Linux password brute-force tool
Indicator blocking
Unsigned process injecting into a Windows system binary with no command line
Remote service command execution from an uncommon source
Netcat makes or gets connections
TGT request with a spoofed sAMAccountName - Network
Suspicious execution of ODBCConf
Fodhelper.exe UAC bypass
LOLBAS executable injects into another process
Kubernetes vulnerability scanner activity
Run downloaded script using pipe
Uncommon remote scheduled task creation
Globally uncommon process execution from a signed process
A service was disabled
A TCP stream was created directly in a shell
Copy a user's GnuPG directory with rsync
Rare process spawned by srvany.exe
Kubernetes secret enumeration activity
Globally uncommon root domain from a signed process
Ping to localhost from an uncommon, unsigned parent process
Uncommon Service Create/Config
A contained executable from a mounted share initiated a suspicious outbound network connection
Possible code downloading from a remote host by Regsvr32
Certutil pfx parsing
Possible malicious .NET compilation started by a commonly abused process
Rare security product signed executable executed in the network
Command running with COMSPEC in the command line argument
Copy a process memory file
Windows Event Log was cleared using wevtutil.exe
Command execution via wmiexec
Uncommon communication to an instant messaging server
A compressed file was exfiltrated over SSH
Suspicious Process Spawned by wininit.exe
XDR Agent, eXtended Threat Hunting (XTH)
Possible internal data exfiltration over a USB storage device
A user accessed an abnormal number of remote shared folders
Suspicious access to cloud credential files
A user took numerous screenshots
Possible LDAP enumeration by unsigned process
Suspicious reconnaissance using LDAP
User collected remote shared files in an archive
Possible data exfiltration over a USB storage device
A user connected a new USB storage device to multiple hosts
A contained process attempted to escape using the 'notify on release' feature
Massive file activity abnormal to process
A user accessed an abnormal number of files on a remote shared folder
Outlook files accessed by an unsigned process
Massive file compression by user
A user performed suspiciously massive file activity
Unusual ADConnect database file access
Space after filename
Rare scheduled task created
A suspicious executable with multiple file extensions was created
Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
Suspicious PowerSploit's recon module (PowerView) net function was executed
Unusual access to the Windows Internal Database on an ADFS server
Commonly abused AutoIT script drops an executable file to disk
PowerShell pfx certificate extraction
Elevation to SYSTEM via services
Possible Persistence via group policy Registry keys
New process created via a WMI call
Suspicious Print System Remote Protocol usage by a process
Possible use of a networking driver for network sniffing
Suspicious active setup registered
A remote service was created via RPC over SMB
A suspicious process queried AD CS objects via LDAP
Suspicious access to shadow file
SecureBoot was disabled
Office process accessed an unusual .LNK file
Modification of NTLM restrictions in the Registry
A compiled HTML help file wrote a script file to the disk
Windows event logs were cleared with PowerShell
Change of sudo caching configuration
Unusual use of a 'SysInternals' tool
Suspicious process modified RC script file
Uncommon Security Support Provider (SSP) registered via a registry key
LDAP search query from an unpopular and unsigned process
Uncommon PowerShell commands used to create or alter scheduled task parameters
A user created an abnormal password-protected archive
LSASS dump file written to disk
Uncommon creation or access operation of sensitive shadow copy
User discovery via WMI query execution
An unusual archive file creation by a user
Uncommon access to Microsoft Teams credential files
Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
A user added a Windows firewall rule
A WMI subscriber was created
Suspicious disablement of the Windows Firewall using PowerShell commands
Uncommon GetClipboardData API function invocation of a possible information stealer
Creation or modification of the default command executed when opening an application
Uncommon AT task-job creation by user
Suspicious DotNet log file created
Suspicious LDAP search query executed
Unusual access to the AD Sync credential files
Linux system firewall was modified
Suspicious Udev driver rule execution manipulation
Editing ld.so.preload for persistence and injection
Scheduled Task hidden by registry modification
Microsoft Office adds a value to autostart Registry key
Suspicious process changed or created the ssh_authorized_keys file
System profiling WMI query execution
Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
A user connected a USB storage device for the first time
Uncommon jsp file write by a Java process
Suspicious AMSI decode attempt
Sensitive browser credential files accessed by a rare non browser process
Browser bookmark files accessed by a rare non-browser process
Unusual Kubernetes service account file read
An uncommon file was created in the startup folder
A suspicious direct syscall was executed
A user created a pfx file for the first time
Uncommon SetWindowsHookEx API invocation of a possible keylogger
Tampering with the Windows User Account Controls (UAC) configuration
DSC (Desired State Configuration) lateral movement using PowerShell
Executable created to disk by lsass.exe
An unpopular process accessed the microphone on the host
Suspicious process accessed certificate files
Possible Distributed File System Namespace Management (DFSNM) abuse
A user connected a new USB storage device to a host
AWS Audit Log, Azure Audit Log, Gcp Audit Log
Cloud user performed multiple actions that were denied
Storage enumeration activity
Multiple cloud snapshots export
Suspicious identity downloaded multiple objects from a bucket
Allocation of multiple cloud compute resources
Multiple failed logins from a single IP
Deletion of multiple cloud resources
Allocation of compute resources in multiple regions
Kubernetes enumeration activity
An identity performed a suspicious download of multiple cloud storage objects
An identity dumped multiple secrets from a project
Multi region enumeration activity
Impossible travel by a cloud identity
An operation was performed by an identity from a domain that was not seen in the organization
A cloud snapshot was created or modified
A Kubernetes namespace was created or deleted
A Kubernetes ConfigMap was created or deleted
A cloud storage configuration was modified
Unusual resource modification by newly seen IAM user
A Kubernetes deployment was created or deleted
A Kubernetes service was created or deleted
Unusual key management activity
A Kubernetes API operation was successfully invoked by an anonymous user
Suspicious API call from a Tor exit node
Cloud identity reached a throttling API rate
A cloud identity had escalated its permissions
Log4J exploitation attempt against cloud hosted resources
Activity in a dormant region of a cloud project
Unusual resource modification/creation
Unusual secret management activity
Unusual certificate management activity
Suspicious heavy allocation of compute resources - possible mining activity
Unusual cross projects activity
Billing admin role was removed
Penetration testing tool activity
A Kubernetes service account was created or deleted
Windows Event Collector, XDR Agent
Interactive local account enumeration
Possible Brute-Force attempt
A user authenticated with weak NTLM to multiple hosts
Remote account enumeration
Multiple users authenticated with weak NTLM to a host
Account probing
Unusual weak authentication by user
A rare local administrator login
Interactive login by a service account
Interactive login by a machine account
Possible Pass-the-Hash
A Successful login from TOR
Possible Kerberos relay attack
Interactive login from a shared user account
Palo Alto Networks Platform Logs
A user accessed multiple time-consuming websites
Increase in Job-Related Site Visits
Massive upload to a rare storage or mail domain
A user accessed an uncommon AppID
AzureAD
SSO Password Spray
Intense SSO failures
SSO Brute Force
Suspicious Azure AD interactive sign-in using PowerShell
Suspicious authentication with Azure Password Hash Sync user
SSO authentication by a machine account
Okta
A user accessed multiple unusual resources via SSO
A user rejected an SSO request from an unusual country
Multiple SSO MFA attempts were rejected by a user
Suspicious SSO authentication
Windows Event Collector, XDR Agent, eXtended Threat Hunting (XTH)
Short-lived user account
Excessive user account lockouts
A user printed an unusual number of files
A user sent multiple TGT requests to irregular service
Multiple suspicious user accounts were created
Multiple TGT requests for users without Kerberos pre-authentication
User added to a group and removed
Multiple user accounts were deleted
A new machine attempted Kerberos delegation
A user received multiple weakly encrypted service tickets
A user was added to a Windows security group
Suspicious modification of the AdminSDHolder's ACL
Sensitive account password reset attempt
A machine certificate was issued with a mismatch
TGT request with a spoofed sAMAccountName - Event log
A user account was modified to password never expires
Machine account was added to a domain admins group
Mailbox Client Access Setting (CAS) changed
Rare machine account creation
SPNs cleared from a machine account
Suspicious hidden user created
Discovery of misconfigured certificate templates using LDAP
PowerShell used to remove mailbox export request logs
A computer account was promoted to DC
A user enabled a default local account
Service ticket request with a spoofed sAMAccountName
Masquerading as a default local account
Suspicious local user account creation
PowerShell used to export mailbox contents
User added SID History to an account
Security tools detection attempt
Suspicious domain user account creation
User account delegation change
Suspicious sAMAccountName change
A user changed the Windows system time
Administrator groups enumerated via LDAP
VM Detection attempt
Palo Alto Networks Global Protect, Third-Party VPNs
VPN login Brute-Force attempt
Impossible traveler - VPN
A disabled user attempted to log in to a VPN
VPN login with a machine account
VPN login by a service account
VPN access with an abnormal operating system
A user connected to a VPN from a new country
First VPN access attempt from a country in organization
A user logged in at an unusual time via VPN
First VPN access from ASN for user
VPN login by a dormant user
A Successful VPN connection from TOR
First VPN access from ASN in organization
Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit
Massive file downloads from SaaS service
Massive upload to SaaS service
Suspicious SaaS API call from a Tor exit node
AWS Flow Log, AWS OCSF Flow Logs, Azure Flow Log, Gcp Flow Log
An internal Cloud resource performed port scan on external networks
AzureAD, Okta
Impossible traveler - SSO
SSO with abnormal user agent
SSO with abnormal operating system
Suspicious SSO access from ASN
SSO with new operating system
First SSO access from ASN in organization
A user logged in at an unusual time via SSO
First SSO access from ASN for user
AWS Audit Log
Suspicious objects encryption in an AWS bucket
MFA device was removed/deactivated from an IAM user
Cloud Watch alarm deletion
AWS config resource deletion
Cloud Trail Logging has been stopped/suspended
An IAM group was created
IAM User added to an IAM group
Remote usage of AWS Lambda's token
Cloud Trail logging deletion
Unusual AWS systems manager activity
An AWS RDS Global Cluster Deletion
AWS EC2 instance exported into S3
S3 configuration deletion
AWS CloudWatch log stream deletion
AWS network ACL rule deletion
An identity created or updated password for an IAM user
AWS Flow Logs deletion
Penetration testing tool attempt
Remote usage of an AWS service token
Disable encryption operations
AWS Cloud Trail log trail modification
Suspicious usage of EC2 token
AWS RDS cluster deletion
AWS user creation
AWS Role Trusted Entity modification
An identity attached an administrative policy to an IAM user
AWS System Manager API call execution
AWS Config Recorder stopped
AWS Root account activity
AWS web ACL deletion
AWS Guard-Duty detector deletion
AWS CloudWatch log group deletion
A compute-attached identity executed API calls outside the instance's region
A user logged in to the AWS console for the first time
AWS network ACL rule creation
EC2 snapshot attribute has been modification
Aurora DB cluster stopped
AWS IAM resource group deletion
AzureAD Audit Log
Multiple Azure AD admin role removals
Short-lived Azure AD user account
First Azure AD PowerShell operation for a user
Azure account creation by a non-standard account
BitLocker key retrieval
Azure service principal assigned app role
Conditional Access policy removed
Azure application credentials added
Azure domain federation settings modification attempt
Owner added to Azure application
Identity assigned an Azure AD Administrator Role
Azure application consent
Azure account deletion by a non-standard account
Azure AD PIM role settings change
Unverified domain added to Azure AD
Azure AD PIM alert disabled
MFA was disabled for an Azure identity
Unusual guest user invitation
Unusual Conditional Access operation for an identity
Azure AD account unlock/password reset attempt
Authentication method added to an Azure account
Azure application URI modification
Azure Temporary Access Pass (TAP) registered to an account
Device Registration Policy modification
Azure AD PIM elevation request
AWS Audit Log, Gcp Audit Log
IAM Enumeration sequence
Suspicious cloud infrastructure enumeration activity
Unusual cloud identity impersonation
A cloud function was created with an unusual runtime
Unusual IAM enumeration activity by a non-user Identity
A cloud identity executed an API call from an unusual country
Unusual Identity and Access Management (IAM) activity
Cloud impersonation attempt by unusual identity type
Office 365 Audit
User moved Exchange sent messages to deleted items
Exchange mailbox delegation permissions added
A user uploaded malware to SharePoint or OneDrive
Exchange malware filter policy removed
Exchange email-hiding inbox rule
Exchange audit log disabled
Exchange inbox forwarding rule configured
Penetration testing tool activity attempt
Microsoft 365 DLP policy disabled or removed
Exchange mailbox folder permission modification
SharePoint Site Collection admin group addition
Exchange transport forwarding rule configured
Exchange compliance search created
Exchange mailbox audit bypass
Exchange anti-phish policy disabled or removed
Exchange email-hiding transport rule
Exchange DKIM signing configuration disabled
Exchange user mailbox forwarding
Exchange Safe Link policy disabled or removed
Exchange Safe Attachment policy disabled or removed
Azure Audit Log
Azure Storage Account key generated
Azure Automation Webhook creation
Azure Key Vault modification
Azure Network Watcher Deletion
Azure Event Hub Deletion
Azure diagnostic configuration deletion
Azure Blob Container Access Level Modification
Azure Automation Runbook Creation/Modification
Azure Automation Account Creation
Remote usage of an Azure Managed Identity token
Azure Event Hub Authorization rule creation/modification
Azure Resource Group Deletion
Azure Automation Runbook Deletion
Azure virtual machine commands execution
An Azure Firewall policy deletion
Remote usage of an Azure Service Principal token
Palo Alto Networks Platform Logs, XDR Agent, Third-Party Firewalls
Recurring access to rare IP
Suspicious SMB connection from domain controller
A Torrent client was detected on a host
Google Workspace Audit Logs
A mail forwarding rule was configured in Google Workspace
A Google Workspace service was configured as unrestricted
A third-party application's access to the Google Workspace domain's resources was revoked
A Google Workspace Role privilege was deleted
Gmail routing settings changed
An app was added to the Google Workspace trusted OAuth apps list
A third-party application was authorized to access the Google Workspace APIs
A Google Workspace user was added to a group
A GCP service account was delegated domain-wide authority in Google Workspace
A domain was added to the trusted domains list
Google Workspace organizational unit was modified
A Google Workspace identity used the security investigation tool
Google Marketplace restrictions were modified
A Google Workspace user was removed from a group
A Google Workspace identity created, assigned or modified a role
External Sharing was turned on for Google Drive
An app was added to Google Marketplace
Data Sharing between GCP and Google Workspace was disabled
A Google Workspace identity performed an unusual admin console activity
An app was removed from a blocked list in Google Workspace
Admin privileges were granted to a Google Workspace user
MFA Disabled for Google Workspace
Gmail delegation was turned on for the organization
Google Workspace third-party application's security settings were changed
Google Workspace Audit Logs, Office 365 Audit
User accessed SaaS resource via anonymous link
Palo Alto Networks Url Logs
A non-browser process accessed a website UI
Non-browser access to a pastebin-like site
PowerShell Initiates a Network Connection to GitHub
Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
Uncommon network tunnel creation
AzureAD, Okta, OneLogin, PingOne
A disabled user attempted to authenticate via SSO
A user connected from a new country
A successful SSO sign-in from TOR
SSO authentication by a service account
User attempted to connect from a suspicious country
First connection from a country in organization
Gcp Audit Log
Suspicious GCP compute instance metadata modification
GCP VPC Firewall Rule Deletion
GCP Storage Bucket Permissions Modification
GCP Service Account Disable
GCP Logging Sink Deletion
GCP Virtual Private Network Route Creation
GCP IAM Service Account Key Deletion
GCP Logging Sink Modification
Cloud Organizational policy was created or modified
GCP Storage Bucket Configuration Modification
GCP Service Account key creation
GCP Firewall Rule creation
GCP Storage Bucket deletion
GCP Service Account creation
GCP Virtual Private Cloud (VPC) Network Deletion
Kubernetes vulnerability scanner activity by API server logs
GCP Firewall Rule Modification
Remote usage of VM Service Account token
GCP Service Account deletion
GCP Pub/Sub Topic Deletion
GCP IAM Custom Role Creation
GCP Virtual Private Network Route Deletion
Remote usage of an App engine Service Account token
GCP Pub/Sub Subscription Deletion
GCP IAM Role Deletion
GCP Logging Bucket Deletion

Back to home page