Alerts by name

Every Analytics alert that Cortex can raise, listed alphabetically. Select an alert to see what it means and what you should do about it.

Alert
A Backup vault policy was modified
A browser extension was installed or loaded in an uncommon way
A browser was opened in private mode
A Cloud DB instance was exported to an unknown destination
A cloud function was created with an unusual runtime
A cloud identity created or modified a security group
A cloud identity executed an API call from an unusual country
A cloud identity had escalated its permissions
A cloud identity invoked IAM related persistence operations
A cloud identity performed multiple unusual activities
A cloud identity started a Cloud Shell session
A cloud instance was stopped
A cloud snapshot of AWS database or storage was modified or shared
A cloud storage configuration was modified
A cloud storage object was copied to a foreign cloud account
A Command Line Interface (CLI) command was executed from a GCP serverless compute service
A Command Line Interface (CLI) command was executed from an AWS serverless compute service
A commonly abused process connected to a rare cloud resource
A commonly abused process connected to a rare external host
A compiled HTML help file wrote a script file to the disk
A compressed file was exfiltrated over SSH
A compromised process accessed a rare cloud resource
A compromised process accessed a rare external host
A compute-attached identity executed API calls outside the instance's region
A computer account was promoted to DC
A contained executable from a mounted share initiated a suspicious outbound network connection
A contained executable was executed by an unusual process
A contained process attempted to escape using the 'notify on release' feature
A container registry was created or deleted
A disabled user attempted to authenticate via SSO
A disabled user attempted to log in
A disabled user attempted to log in to a VPN
A domain was added to the trusted domains list
A GCP Cloud SQL DB instance was exported from a production account
A GCP service account was delegated domain-wide authority in Google Workspace
A Google Workspace identity created, assigned or modified a role
A Google Workspace identity performed an unusual admin console activity
A Google Workspace identity used the security investigation tool
A Google Workspace Role privilege was deleted
A Google Workspace service was configured as unrestricted
A Google Workspace user was added to a group
A Google Workspace user was removed from a group
A Kubernetes API operation was successfully invoked by an anonymous user
A Kubernetes cluster role binding was created or deleted
A Kubernetes cluster role was created
A Kubernetes cluster was created or deleted
A Kubernetes ConfigMap was created or deleted
A Kubernetes Cronjob was created
A Kubernetes DaemonSet was created
A Kubernetes dashboard service account was used outside the cluster
A Kubernetes deployment was created
A Kubernetes ephemeral container was created
A Kubernetes namespace was created or deleted
A Kubernetes node service account activity from external IP
A Kubernetes Pod was created with a sidecar container
A Kubernetes Pod was deleted
A Kubernetes ReplicaSet was created
A Kubernetes role binding was created or deleted
A Kubernetes secret was created or deleted
A Kubernetes service account executed an unusual API call
A Kubernetes service account has enumerated its permissions
A Kubernetes service account was created or deleted
A Kubernetes service was created or deleted
A Kubernetes StatefulSet was created
A LOLBIN was copied to a different location
A machine certificate was issued with a mismatch
A mail forwarding rule was configured in Google Workspace
A Microsoft Teams application was installed
A Microsoft Teams bot was added to a team
A new Azure email domain verification was requested
A new machine attempted Kerberos delegation
A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
A non-browser process accessed a website UI
A Possible crypto miner was detected on a host
A possible risky login to Azure
A process connected to a rare cloud resource
A process connected to a rare external host
A process connected to rare external host
A process is masquerading as a common Microsoft product
A process modified an SSH authorized_keys file
A process queried the ADFS database decryption key via LDAP
A process was executed with a command line obfuscated by Unicode character substitution
A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process
A rare file path was added to the AppInit_DLLs registry value
A rare FTP user has been detected on an existing FTP server
A rare local administrator login
A remote service was created via RPC over SMB
A Service Principal was created in Azure
A Service Principal was removed from Azure
A service was disabled
A Successful login from TOR
A successful SSO sign-in from TOR
A Successful VPN connection from TOR
A suspicious direct syscall was executed
A suspicious executable with multiple file extensions was created
A suspicious process enrolled for a certificate
A suspicious process queried AD CS objects via LDAP
A TCP stream was created directly in a shell
A third-party application was authorized to access the Google Workspace APIs
A third-party application's access to the Google Workspace domain's resources was revoked
A third-party utility was copied to a different location
A Torrent client was detected on a host
A user accessed an abnormal number of files on a remote shared folder
A user accessed an abnormal number of remote shared folders
A user accessed an uncommon AppID
A user accessed multiple time-consuming websites
A user accessed multiple unusual resources via SSO
A user accessed Okta's admin application
A user account was modified to password never expires
A user added a Windows firewall rule
A user attempted to bypass Okta MFA
A user authenticated with weak NTLM to multiple hosts
A user certificate was issued with a mismatch
A user changed the Windows system time
A user connected a new USB storage device to a host
A user connected a new USB storage device to multiple hosts
A user connected a USB storage device for the first time
A user connected from a new country
A user connected to a VPN from a new country
A user created a pfx file for the first time
A user created an abnormal password-protected archive
A user enabled a default local account
A user established an SMB connection to multiple hosts
A user executed multiple LDAP enumeration queries
A user logged in at an unusual time via SSO
A user logged in at an unusual time via VPN
A user logged in from an abnormal country or ASN
A user logged in to the AWS console for the first time
A user logged on to multiple workstations via Schannel
A user modified an Okta MFA factor
A user modified an Okta network zone
A user modified an Okta policy rule
A user modified the CA audit policy
A user observed and reported unusual activity in Okta
A user performed suspiciously massive file activity
A user printed an unusual number of files
A user queried AD CS objects via LDAP
A user received multiple weakly encrypted service tickets
A user rejected an SSO request from an unusual country
A user requested multiple service tickets
A user sent multiple TGT requests to irregular service
A user took numerous screenshots
A user uploaded malware to SharePoint or OneDrive
A user was added to a Windows security group
A WMI subscriber was created
Abnormal Allocation of compute resources in multiple regions
Abnormal Communication to a Rare Domain
Abnormal communication with a rare combination of TLS and HTTP User Agent
Abnormal connections to a dormant host from a newly seen endpoint
Abnormal File Activity in SCCMContentLib Shared Folder by user
Abnormal ICMP echo (PING) to multiple hosts
Abnormal increase in network-related alerts on the same host
Abnormal network communication through TOR using an uncommon port
Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server
Abnormal process connection to default Meterpreter port
Abnormal RDP connections to multiple hosts
Abnormal RDP connections to multiple hosts from a rarely seen host
Abnormal RDP session to a remote host from a rarely seen host
Abnormal Recurring Communications to a Rare Domain
Abnormal RPC traffic to multiple hosts
Abnormal sensitive RPC traffic to multiple hosts
Abnormal sensitive RPC traffic to multiple hosts from a rarely seen host
Abnormal SMB activity to multiple hosts
Abnormal SMB scanning activity to multiple hosts
Abnormal User Login to Domain Controller
Access to kubelet credentials file
Access to Kubernetes CA certificate file
Access to Kubernetes configuration file
Access to sensitive host files from within a Kubernetes pod
Account probing
Adding execution privileges
ADFS DKM Key Access
Admin privileges were granted to a Google Workspace user
Administrator groups enumerated via LDAP
AI model discovery
AI safeguards deletion attempt
AI safeguards were modified
AI-determined combination of risky alerts under the same actor process
AI-determined combination of risky alerts under the same causality
Allocation of multiple cloud compute resources
An app was added to Google Marketplace
An app was added to the Google Workspace trusted OAuth apps list
An app was removed from a blocked list in Google Workspace
An AWS database service master user password was changed
An AWS EC2 instance containing sensitive data was exported
An AWS EC2 instance was exported from a production account
An AWS EC2 instance was exported into an unknown S3 bucket
An AWS EFS File-share mount was deleted
An AWS EFS file-share was deleted
An AWS EKS cluster was created or deleted
An AWS GuardDuty IP set was created
An AWS Lambda Function was created
An AWS Lambda function was modified
An AWS RDS Global Cluster Deletion
An AWS RDS instance was created from a snapshot
An AWS Route 53 domain was transferred to another AWS account
An AWS S3 bucket configuration was modified
An AWS SAML provider was modified
An AWS SES identity was deleted
An Azure application reached a throttling API rate
An Azure DNS Zone was modified
An Azure Firewall policy deletion
An Azure Firewall rule collection group was modified or deleted
An Azure firewall rule group was modified
An Azure Firewall was modified
An Azure identity performed multiple actions that were denied
An Azure Key Vault key was modified
An Azure Key Vault was modified
An Azure Kubernetes Cluster was created or deleted
An Azure Kubernetes Role or Cluster-Role was modified
An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted
An Azure Kubernetes Service Account was modified or deleted
An Azure Network Security Group was modified
An Azure Point-to-Site VPN was modified
An Azure SQL database was exported from a production subscription
An Azure Suppression Rule was created
An Azure virtual network Device was modified
An Azure virtual network was modified
An Azure VM snapshot SAS URL was generated
An Azure VM snapshot SAS URL was generated for export from a production subscription
An Azure VPN Connection was modified
An EBS snapshot block was downloaded
An Email address was added to AWS SES
An executable was written and executed by a web server
An IAM group was created
An identity accessed a backup cloud storage
An identity accessed a cloud storage for the first time
An identity accessed Azure Kubernetes Secrets
An identity attached an administrative policy to an IAM user or role
An identity created or updated password for an IAM user
An identity disabled bucket logging
An identity initiated a download of multiple cloud objects
An identity performed a suspicious download of multiple cloud storage objects
An identity started an AWS SSM session
An identity successfully extracted multiple secrets within the organization
An identity was granted permissions to manage user access to Azure resources
An inactive user attempted to authenticate
An internal Cloud resource performed port scan on external networks
An operation was performed by an identity from a domain that was not seen in the organization
An RDS snapshot containing sensitive data was exported
An RDS snapshot was exported from a production account
An RDS snapshot was exported to an unknown bucket
An RDS snapshot was exported to an unknown S3 bucket
An S3 replication policy to an unknown bucket was created
An uncommon executable was remotely written over SMB to an uncommon destination
An uncommon file added to startup-related Registry keys
An uncommon file was created in the startup folder
An uncommon lolbin execution by scheduled task
An uncommon RDP session from a managed host
An uncommon RDP session was established
An uncommon service was started
An unknown account was invited to the AWS organization
An unpopular process accessed the microphone on the host
An unsigned process created scheduled task and performed an injection
An unusual archive file creation by a user
An unusual cloud identity was granted permissions to a BigQuery resource
An unusual process in ingress-nginx has accessed a service-account token file
An unusual read activity of cloud object
Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert
AppleScript executed a shell script
AppleScript interpreter dynamic library loaded into a process
AppleScript process executed with a rare command line
Attempt to execute a command on a remote host using PsExec.exe
Attempted Azure application access from unknown tenant
Aurora DB cluster stopped
Authentication attempt by a honey user
Authentication Attempt From a Dormant Account
Authentication method added to an Azure account
Authentication method was added to Azure account
Autorun.inf created in root C drive
AWS Backup recovery point deletion
AWS Backup vault was deleted
AWS Bedrock AI infrastructure enumeration activity
AWS Bedrock model invocation logging deletion
AWS CloudTrail has been stopped
AWS CloudTrail modification
AWS CloudWatch log group deletion
AWS CloudWatch log stream deletion
AWS Config Recorder stopped
AWS config resource deletion
AWS console login without MFA
AWS data asset shared public
AWS EBS enumeration activity
AWS EBS snapshot deletion
AWS EC2 infrastructure enumeration activity
AWS EC2 instance exported into S3
AWS Flow Logs deletion
AWS Guard-Duty detector deletion
AWS IAM resource group deletion
AWS IAM Role Created with Cross-Account Access
AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access
AWS Lambda Cross-Account sensitive permissions configured
AWS Lambda infrastructure enumeration activity
AWS network ACL rule creation
AWS network ACL rule deletion
AWS Password Policy Discovery
AWS principals discovery
AWS RDS cluster deletion
AWS resource discovery
AWS root account activity
AWS S3 bucket data retention policy change through S3 Lifecycle rule
AWS S3 bucket was exposed to public access
AWS S3 Buckets enumeration activity
AWS Secrets Manager discovery
AWS Security Group remote access allowed from an unknown external IP address
AWS Security Service Enumeration
AWS SecurityHub findings were modified
AWS SES account sending settings modified
AWS SSM association created with inventory collection document
AWS SSM parameters discovery
AWS SSM parameters retrieval
AWS SSM send command attempt
AWS Storage Gateway enumeration
AWS Storage Gateway file share enumeration
AWS STS temporary credentials were generated
AWS support case creation
AWS Systems Manager hosts enumeration
AWS Transfer Family server created
AWS user creation
AWS web ACL deletion
Azure account creation by a non-standard account
Azure account deletion by a non-standard account
Azure AD account unlock/password reset attempt
Azure AD PIM alert disabled
Azure AD PIM elevation request
Azure AD PIM role settings change
Azure application consent
Azure application credentials added
Azure application removed
Azure application URI modification
Azure Automation Account Creation
Azure Automation Runbook Creation/Modification
Azure Automation Runbook Deletion
Azure Automation Webhook creation
Azure Blob Container Access Level Modification
Azure conditional access policy creation or modification
Azure device code authentication flow used
Azure diagnostic configuration deletion
Azure domain federation settings modification attempt
Azure enumeration activity using Microsoft Graph API
Azure Event Hub Authorization rule creation/modification
Azure Event Hub Deletion
Azure group creation/deletion
Azure Key Vault modification
Azure Key Vault Secrets were modified
Azure Kubernetes events were deleted
Azure mailbox rule creation
Azure Monitor alert rule deleted
Azure Network Watcher Deletion
Azure permission delegation granted
Azure Privilege Escalation Using an Application
Azure Resource Group Deletion
Azure route table creation or modification
Azure service principal assigned app role
Azure Service principal/Application creation
Azure storage account blob anonymous access is enabled
Azure storage account cross-tenant object replication was enabled
Azure Storage Account key generated
Azure storage account was publicly shared
Azure Temporary Access Pass (TAP) registered to an account
Azure user creation/deletion
Azure user password reset
Azure virtual machine commands execution
Azure VM extension abuse attempt
Bedrock model shared with a foreign account
BigQuery table or query results exfiltrated to a foreign project
Billing admin role was removed
BitLocker key retrieval
Bitsadmin.exe persistence using command-line callback
Broker Collection Error
Bronze-Bit exploit
Browser bookmark files accessed by a rare non-browser process
Browser Extension Installed
Brute-force attempt on a local account
Bucket's block public access setting turned off
Bucket's object ownership controls were modified
Cached credentials discovery with cmdkey
Certutil pfx parsing
Change of sudo caching configuration
Chrome Extension Installed By User
Chrome OS Remote Access policy was modified in Google Workspace
ClickFix - PowerShell executed through the run application
Cloud access key creation
Cloud activity from a high-risk IP address
Cloud AI agent was modified
Cloud compute instance user data script modification
Cloud compute serial console access
Cloud compute volume creation attempt
Cloud email infrastructure enumeration activity
Cloud email sending was enabled
Cloud email service activity
Cloud identity reached a throttling API rate
Cloud IMDS access followed by remote token usage
Cloud impersonation attempt by unusual identity type
Cloud infrastructure discovery across multiple regions
Cloud infrastructure enumeration activity
Cloud instance creation attempt
Cloud instance deletion attempt
Cloud Organizational policy was created or modified
Cloud penetration testing tool activity
Cloud resource logging was disabled
Cloud snapshot created or modified
Cloud snapshot of a database or storage instance was publicly shared
Cloud storage automatic backup disabled
Cloud storage delete protection disabled
Cloud user performed multiple actions that were denied
Cloud Watch alarm deletion
CloudTrail logging deletion
Collection error
Command execution in a Kubernetes pod
Command execution via AWS SSM
Command execution via wmiexec
Command running with COMSPEC in the command line argument
Common third-party software name masquerading
Commonly abused AutoIT script connects to an external domain
Commonly abused AutoIT script drops an executable file to disk
Commonly abused process launched as a system service
Compressing data using python
Compute activity in dormant cloud region
Conditional Access policy removed
Conhost.exe spawned a suspicious cmd process
Contained process execution with a rare GitHub URL
Copy a process memory file
Copy a user's GnuPG directory with rsync
Correlation rule error
Creation or modification of the default command executed when opening an application
Credentials were added to Azure application
Data encryption was disabled
Data exfiltration from cloud database
Data Sharing between GCP and Google Workspace was disabled
Delayed Deletion of Files
Deletion of AD CS certificate database entries
Deletion of multiple cloud resources
Denied API call by a Kubernetes service account
Device Registration Policy modification
Disable AWS audit logs through Event Selectors
Disable encryption operations
Disable Microsoft Defender Antivirus via registry
Discovery of accounts with pre-authentication disabled via LDAP
Discovery of host users via WMIC
Discovery of misconfigured certificate templates using LDAP
Display text URL differs from actual URL
DLP sensitive data exposed to external users
DNS Tunneling
Download a script using the python requests module
Download pattern that resembles Peer to Peer traffic
DSC (Desired State Configuration) lateral movement using PowerShell
EBS snapshots were created from an EC2 instance
EBS volume attachment attempt
EBS volume detachment attempt
EC2 backdoor created with newly added external SSH or RDP access
EC2 instance Amazon machine image was created
Elevation to SYSTEM via services
Email attachment with a potentially malicious file extension
Email attachment with multiple extensions
Email attachment with Right-to-Left Override Unicode character
Email attachment(s) with potentially malicious MIME type
Email containing a link with an IP address convention was detected
Email containing a redirected link
Email contains URL delivering high-risk file type
Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
Email mimics replies or forwards without an actual ongoing conversation
Email sent using an automated system or script detected
Email was received from an unknown address using a public provider domain
Email was received from an unknown sender using a disposable domain
Email with file-sharing link containing auto-download parameter
Email with URL shortener detected
Encoded information using Windows certificate management tool
Error in event forwarding
Excessive user account lockouts
Exchange anti-phish policy disabled or removed
Exchange audit log disabled
Exchange compliance search created
Exchange DKIM signing configuration disabled
Exchange email-hiding inbox rule
Exchange email-hiding transport rule
Exchange inbox forwarding rule configured
Exchange mailbox audit bypass
Exchange mailbox delegation permissions added
Exchange mailbox folder permission modification
Exchange malware filter policy removed
Exchange Safe Attachment policy disabled or removed
Exchange Safe Link policy disabled or removed
Exchange transport forwarding rule configured
Exchange user mailbox forwarding
Executable created to disk by lsass.exe
Executable moved to Windows system folder
Executable or Script file written by a web server process
Execution of an uncommon process at an early startup stage
Execution of an uncommon process at an early startup stage by Windows system binary
Execution of an uncommon process with a local/domain user SID at an early startup stage
Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary
Execution of command from within a Kubernetes pod using kubelet credentials
Execution of dllhost.exe with an empty command line
Execution of masqueraded third-party utility
Execution of renamed lolbin
External email display name impersonation of internal personnel
External email with a single internal recipient hidden in BCC
External Login Password Spray
External SaaS file-sharing activity
External Sharing was turned on for Google Drive
External user added a link to a Microsoft Teams chat
External user call via Microsoft Teams
External user created a Microsoft Teams conversation with suspicious operations
External user invitation to Azure tenant
External user started a Microsoft Teams conversation
Extracting credentials from Unix files
Failed Connections
Failed DNS
Failed Login For a Long Username With Special Characters
Failed Login For Locked-Out Account
File transfer from unusual IP using known tools
First Azure AD PowerShell operation for a user
First connection from a country in organization
First SSO access from ASN for user
First SSO access from ASN in organization
First SSO Resource Access in the Organization
First VPN access attempt from a country in organization
First VPN access from ASN for user
First VPN access from ASN in organization
First-seen email from mailbox owner to external recipient's address in the last 30 days
First-time attachment exchange
First-time directory sync of an on-premises domain user to an existing cloud account
Fodhelper.exe UAC bypass
Foreign account was granted permissions to S3 bucket via resource-based policy
FTP Connection Using an Anonymous Login or Default Credentials
GCP administrative role granted to a cloud identity
GCP data asset shared public
GCP Firewall Rule creation
GCP Firewall Rule Modification
GCP IAM deny policy creation
GCP IAM Role Deletion
GCP IAM Service Account Key Deletion
GCP Logging Bucket Deletion
GCP logging sink deletion
GCP logging sink modification
GCP Pub/Sub Subscription Deletion
GCP Pub/Sub Topic Deletion
GCP sensitive Cloud Run role granted
GCP sensitive compute role granted
GCP sensitive Deployment Manager role granted
GCP sensitive Functions role granted
GCP sensitive IAM role granted
GCP sensitive role granted to group
GCP sensitive Secret Manager role granted
GCP sensitive storage role granted
GCP Service Account creation
GCP Service Account Deletion
GCP Service Account Disable
GCP service account impersonation attempt
GCP Service Account key creation
GCP set IAM policy activity
GCP Storage Bucket Configuration Modification
GCP Storage Bucket deletion
GCP Storage Bucket Permissions Modification
GCP Virtual Private Cloud (VPC) Network Deletion
GCP Virtual Private Network Route Creation
GCP Virtual Private Network Route Deletion
GCP VPC Firewall Rule Deletion
Globally uncommon high entropy module was loaded
Globally uncommon high entropy process was executed
Globally uncommon image load from a signed process
Globally uncommon injection from a signed process
Globally uncommon IP address by a common process (sha256)
Globally uncommon IP address connection from a signed process
Globally uncommon process execution from a signed process
Globally uncommon root domain from a signed process
Globally uncommon root-domain port combination by a common process (sha256)
Globally uncommon root-domain port combination from a signed process
Gmail delegation was turned on for the organization
Gmail routing settings changed
Google Marketplace restrictions were modified
Google Workspace automation was created
Google Workspace organizational unit was modified
Google Workspace third-party application's security settings were changed
Google Workspace user authentication information changed
Granting Access to an Account
Hidden Attribute was added to a file using attrib.exe
HTTP with suspicious characteristics
Hydra Password Brute-Force Tool Execution
IAM Enumeration sequence
IAM inline policy was added to group
IAM inline policy was added to role
IAM inline policy was added to user
IAM instance profile associations were described
IAM instance profile was associated with EC2 instance
IAM instance profile was created
IAM instance profile was replaced for EC2 instance
IAM policy default version was changed
IAM policy version was created
IAM policy was attached to group
IAM policy was attached to role
IAM role trust policy modification
IAM role was created
IAM role-attached managed policies were listed
IAM User added to an IAM group
Identity assigned an Azure AD Administrator Role
Image file execution options (IFEO) registry key set
Impossible travel by a cloud identity
Impossible traveler - SSO
Impossible traveler - VPN
Increase in Job-Related Site Visits
Indicator blocking
Indirect command execution using the Program Compatibility Assistant
Initial person-to-person email contact
Injection into rundll32.exe
Installation of a new System-V service
Intense SSO failures
Interactive at.exe privilege escalation method
Interactive local account enumeration
Interactive login by a machine account
Interactive login by a service account
Interactive login from a shared user account
Internal Login Password Spray
Invalid SAML Detected
IP Rotation Pattern in SSO Spray
Iptables configuration command was executed
Kerberos Pre-Auth Failures by Host
Kerberos Pre-Auth Failures by User and Host
Kerberos Traffic from Non-Standard Process
Kerberos User Enumeration
Key credential attribute modification
Keylogging using system commands
Known service display name with uncommon image-path
Known service name with an uncommon image-path
Kubelet server communication from a pod
Kubernetes admission controller activity
Kubernetes API server communication from within a pod
Kubernetes cluster events deletion
Kubernetes enumeration activity
Kubernetes environment enumeration activity
Kubernetes network policy modification
Kubernetes nsenter container escape
Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
Kubernetes Pod created with host process ID (PID) namespace
Kubernetes Pod Created With Sensitive Volume
Kubernetes pod creation from unknown container image registry
Kubernetes pod creation with host network
Kubernetes Privileged Pod Creation
Kubernetes secret enumeration activity
Kubernetes secrets enumeration for the first time
Kubernetes service account activity outside the cluster
Kubernetes version disclosure
Kubernetes vulnerability scanner activity
Kubernetes vulnerability scanning tool usage
Large Upload (FTP)
Large Upload (Generic)
Large Upload (HTTPS)
Large Upload (SMTP)
Large volume of files potentially containing credentials accessed in Google Drive
LDAP AD CS Enumeration via Attack Tool
LDAP search query from an unpopular and unsigned process
LDAP traffic from non-standard process
Linux local user account creation
Linux network share discovery
Linux process execution with a rare GitHub URL
Linux system firewall was modified
Local account discovery
Local group enumeration
Local group enumeration via RPC
Local user account creation
Local user account creation by a machine account
Local user enumeration via SAMR
Log enumeration via cloud native logging service
Logging was impaired via external encryption key
Login attempt by a honey user
Login by a dormant user
Logs were not collected from a data source for an abnormally long time
LOLBAS executable injects into another process
LOLBIN created a PSScriptPolicyTest PowerShell script file
LOLBIN process executed with a high integrity level
LSASS dump file written to disk
Machine Account NTLM Relay
Machine account was added to a domain admins group
Mailbox Client Access Setting (CAS) changed
Mailbox enumeration activity by Azure application
Manipulation of netsh helper DLLs Registry keys
Masquerading as a default local account
Masquerading as the Linux crond process
Massive file activity abnormal to process
Massive file compression by user
Massive file downloads from SaaS service
Massive files deletion in Box
Massive files deletion in Dropbox
Massive files deletion in Google Drive
Massive files deletion in Microsoft SharePoint or OneDrive
Massive upload to a rare storage or mail domain
Massive upload to SaaS service
Member added to a Windows local security group
Memory dumping with comsvcs.dll
MFA device was removed/deactivated from an IAM user
MFA Disabled for Google Workspace
MFA was disabled for a Google Workspace user
MFA was disabled for an Azure identity
Microsoft 365 DLP policy disabled or removed
Microsoft 365 storage services exfiltration activity
Microsoft Configuration Manager device registration and policy request
Microsoft Office adds a value to autostart Registry key
Microsoft Office injects code into a process
Microsoft Office Process Spawning a Suspicious One-Liner
Microsoft Office process spawns a commonly abused process
Microsoft Office process spawns conhost.exe
Microsoft OneDrive enumeration activity
Microsoft OneNote enumeration activity
Microsoft SharePoint enumeration activity
Microsoft Teams application setup policy was modified
Microsoft Teams enumeration activity
Microsoft Teams external communication policy was modified
Microsoft Teams messages were exported from conversation
Mimikatz command-line arguments
ML artifacts destruction
Modification of NTLM restrictions in the Registry
Modification of PAM
Modification of the AD FS IdentityServer configuration file
Modification or Deletion of an Azure Application Gateway Detected
Moniker link detected in URL(s)
Mount command was executed from within a Kubernetes pod to list all the attached filesystems
MpCmdRun.exe was used to download files into the system
Mshta.exe launched with suspicious arguments
Mshta.exe spawns from a browser process
MSI accessed a web page running a server-side script
Msiexec execution of an executable from an uncommon remote location
Multi region enumeration activity
Multiple alerts associated with a single RDP connection
Multiple alerts of different MITRE tactics were seen
Multiple Azure AD admin role removals
Multiple cloud snapshots export
Multiple discovery commands
Multiple discovery commands on a Linux host by the same process
Multiple discovery commands on a Windows host by the same process
Multiple discovery-like commands
Multiple failed AWS assume role attempts
Multiple failed logins from a single IP
Multiple network-related alerts of different MITRE tactics on the same host
Multiple network-related alerts produced by different detectors on the same host
Multiple Okta MFA requests sent to a user
Multiple Rare LOLBIN Process Executions by User
Multiple Rare Process Executions in Organization
Multiple risk indicators for a cloud identity
Multiple Suspicious FTP Login Attempts
Multiple suspicious user accounts were created
Multiple TGT requests for users without Kerberos pre-authentication
Multiple uncommon SSH Servers with the same Server host key
Multiple user accounts failed login due to account lockouts
Multiple user accounts were deleted
Multiple users authenticated with weak NTLM to a host
Multiple Weakly-Encrypted Kerberos Tickets Received
Near-empty email from an external sender
Netcat makes or gets connections
Network sniffing detected in Cloud environment
New addition to Windows Defender exclusion list
New Administrative Behavior
New cloud identity created with administrative policy
New FTP Server
New Shared User Account
New Teams application published to the organization catalog
Non-browser access to a pastebin-like site
NTDS.dit file written by an uncommon executable
NTLM Brute Force
NTLM Brute Force on a Service Account
NTLM Brute Force on an Administrator Account
NTLM Hash Harvesting
NTLM Password Spray
NTLM Relay
Numerous emails sent by a single sender to multiple internal recipients
Object versioning was disabled
Office process accessed an unusual .LNK file
Office process spawned with suspicious command-line arguments
Okta account reset password attempt
Okta account unlock
Okta account unlock by admin
Okta admin privilege assignment
Okta API Token Created
Okta device assignment
Okta FastPass reported phishing attack suspected
Okta Reported Attack Suspected
Okta Reported Threat Detected
Okta User Session Impersonation
OneDrive file download
OneDrive file upload
OneDrive folder creation
Outbound email contains file-sharing service link sent to external recipient
Outbound email includes an external BCC recipient observed for the first time
Outbound email to an address hosted by a public email service provider
Outlook files accessed by an unsigned process
Owner added to Azure application
Owner was added to Azure application
Parsing Rule Error
Penetration testing tool activity attempt
Permission Groups discovery commands
Phantom DLL Loading
PIM privilege member removal
Ping to localhost from an uncommon, unsigned parent process
PKINIT TGT authentication request
Port Scan
Port Sweep
Possible AS-REP Roasting Attack
Possible authentication coercion
Possible binary padding using dd
Possible Brute Force in universal authentication
Possible brute force on sudo user
Possible brute force or configuration change attempt on cytool
Possible Brute-Force attempt
Possible code downloading from a remote host by Regsvr32
Possible collection of screen captures with Windows Problem Steps Recorder
Possible compromised machine account
Possible ConsentFix - OAuth Token Theft Detected
Possible data exfiltration over a USB storage device
Possible data obfuscation
Possible DCSync from a non domain controller
Possible Distributed File System Namespace Management (DFSNM) abuse
Possible DLL Hijack into a Microsoft process
Possible DLL Search Order Hijacking
Possible Email collection using Outlook RPC
Possible external RDP Brute-Force
Possible GPO Enumeration
Possible Impossible Travel Pattern - SSO
Possible Insider Threat Activity
Possible internal data exfiltration over a USB storage device
Possible IPFS traffic was detected
Possible Kerberoasting attack
Possible Kerberoasting without SPNs
Possible Kerberos relay attack
Possible Kerberos User Enumeration
Possible LDAP enumeration by unsigned process
Possible LDAP Enumeration of Microsoft Configuration Manager
Possible LDAP Enumeration Tool Usage
Possible malicious .NET compilation started by a commonly abused process
Possible multistage attack in Microsoft Teams
Possible network service discovery via command-line tool
Possible network sniffing attempt via tcpdump or tshark
Possible new DHCP server
Possible Pass-the-Hash
Possible Password Spray in universal authentication
Possible path traversal via HTTP request
Possible Persistence via group policy Registry keys
Possible phishing attack via Microsoft Teams
Possible Privilege Escalation using Delegated MSA account
Possible RDP session hijacking using tscon.exe
Possible Search For Password Files
Possible SPN enumeration
Possible TGT reuse from different hosts (pass the ticket)
Possible use of a networking driver for network sniffing
Possible use of IPFS was detected
Possible webshell file written by a web server process
Potential creation of persistent cloud credentials
Potential DCSync by an unusual user
Potential denial of wallet abusing AI services
Potential extraction of NAA Account Credentials in Microsoft Configuration Manager
Potential kubelet impersonation attempt
Potential NTLM Relay Attack
Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server
Potential Okta access limit breach
Potential Phishing has been detected
Potential SCCM credential harvesting using WMI detected
Potential spoofing of internal domain spotted
PowerShell Initiates a Network Connection to GitHub
PowerShell pfx certificate extraction
PowerShell runs suspicious base64-encoded commands
PowerShell suspicious flags
PowerShell used to export mailbox contents
PowerShell used to remove mailbox export request logs
Privileged certificate request via certificate template
Privileged role used by Azure application
Procdump executed from an atypical directory
PsExec was executed with a suspicious command line
Punycode characters detected in URL(s)
Python HTTP server started
Quarantined email released to recipients
Random-Looking Domain Names
Rare access to known advertising domains
Rare AppID usage to a rare destination
Rare binary connected to a rare cloud resource
Rare binary connected to a rare external host
Rare communication over email ports to external email server by unsigned process
Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
Rare DCOM RPC activity
Rare DLP rule match by user
Rare file transfer over SMB protocol
Rare LDAP enumeration
Rare LOLBIN Process Execution by User
Rare machine account creation
Rare MS-Update Server was detected
Rare MS-Update traffic over HTTP
Rare NTLM Access By User To Host
Rare NTLM Usage by User
Rare process accessed a Keychain file
Rare process created an SSH session to an uncommon cloud resource
Rare process created an SSH session to an uncommon external host
Rare process executed by an AppleScript
Rare process execution by user
Rare process execution in organization
Rare process spawned by srvany.exe
Rare process with VNC server capabilities started
Rare RDP session to a remote host
Rare Remote Service (SVCCTL) RPC activity
Rare scheduled task created
Rare Scheduled Task RPC activity
Rare Scheduled Task RPC activity from a rarely seen host
Rare security product signed executable executed in the network
Rare service DLL was added to the registry
Rare signature signed executable executed in the network
Rare SMB session to a remote host
Rare SMTP/S Session
Rare SSH Session
Rare Unix process divided files by size
Rare unsigned process execution by scheduled task
Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
Rare Windows Remote Management (WinRM) HTTP Activity
Rare WinRM Session
Rarely seen sender address in the organization
Rarely seen sender domain in the organization
RDP Connection to localhost
RDP connections enabled remotely via Registry
RDP from an unmanaged endpoint in a typically managed subnet
Reading bash command history file
Recurring access to rare domain
Recurring access to rare IP
Recurring rare domain access from an unsigned process
Recurring rare domain access to dynamic DNS domain
Registration of Uncommon .NET Services and/or Assemblies
Remote account enumeration
Remote code execution into Kubernetes Pod
Remote command execution via wmic.exe
Remote DCOM command execution
Remote PsExec-like command execution
Remote service command execution from an uncommon source
Remote service start from an uncommon source
Remote usage of an App engine Service Account token
Remote usage of an AWS service token
Remote usage of an Azure Managed Identity token
Remote usage of an Azure Service Principal token
Remote usage of AWS Lambda's role
Remote usage of VM Service Account token
Remote WMI process execution
Removal of an Azure Owner from an Application or Service Principal
Retrieval of cloud compute EC2 instance user data
Retrieval of kubelet credentials
Run downloaded script using pipe
Rundll32.exe executes a rare unsigned module
Rundll32.exe running with no command-line arguments
Rundll32.exe spawns conhost.exe
S3 configuration deletion
SAAS - Email was reported by the user or administrator as a phishing attempt
SaaS suspicious external domain user activity
SCCM log files enumeration
Scheduled Task hidden by registry modification
Scrcons.exe Rare Child Process
Screensaver process executed from Users or temporary folder
Script file added to startup-related Registry keys
Scripting engine connected to a rare external host
SecureBoot was disabled
Security object deletion in Google Workspace Admin Console
Security tools detection attempt
Sending unusual file(s) to an external address
Sensitive account password reset attempt
Sensitive browser credential files accessed by a rare non browser process
Sensitive Exchange mail sent to external users
Serial console access was enabled in AWS account
Service execution via sc.exe
Service ticket request with a spoofed sAMAccountName
SES Production Access Requested
Setting Windows Auto Logon by uncommon process
Setuid and Setgid file bit manipulation
SharePoint Site Collection admin group addition
Short-lived Azure AD user account
Short-lived user account
Signed process creates a scheduled task via file access
Signed process performed an unpopular DLL injection
Signed process performed an unpopular injection
Single account excessively locked out
SMB Traffic from Non-Standard Process
Soft delete of cloud storage configuration was disabled
Space after filename
Spam Bot Traffic
SPNs cleared from a machine account
SSH authentication brute force attempts
SSO authentication attempt by a honey user
SSO authentication by a machine account
SSO authentication by a service account
SSO Brute Force
SSO Password Spray
SSO with abnormal operating system
SSO with abnormal user agent
SSO with new operating system
Storage enumeration activity
Stored credentials exported using credwiz.exe
Subdomain Fuzzing
Successful universal authentication with suspicious features
Successful unusual guest user invitation
Sudden spike in outbound email volume
Sudoedit Brute force attempt
SUID/GUID permission discovery
Suspicious .NET process loads an MSBuild DLL