2025.12.31

Release date: 11-January-2026

Summary

Added

• 20 Detectors: 5 Low, 15 Informational
• 27 Variations: 2 High, 6 Medium, 18 Low, 1 Informational

Removed

• 1 Detector: 1 Informational
• 2 Variations: 1 Low, 1 Informational

Modified Logic

• 1125 Detectors: 20 High, 85 Medium, 291 Low, 729 Informational
• 69 Variations: 4 High, 17 Medium, 28 Low, 20 Informational

Added

• [Informational] Uncommon login item persistency was registered or modified

  • [High] Uncommon login item persistency was registered or modified by a security testing tool
  • [Low] Uncommon login item persistency was registered or modified by an invalidly signed actor process
  • [Low] Uncommon login item persistency was registered or modified by an invalidly signed causality process
  • [Low] Uncommon login item persistency was registered or modified while using osascript
• [Informational] Uncommon process communication to a rare external host

  • [High] Uncommon process communication to a rare external host by an automated penetration testing tool
  • [Medium] Uncommon process communication to a rare external host related to LOTTunnels
  • [Medium] Uncommon process communication to a rare external host with a possible crypto mining tool for the first time
  • [Low] Uncommon process communication to a rare external host involving a code sharing website
  • [Low] Uncommon process communication to a rare external host with a possible exfiltration tool
  • [Low] Uncommon process communication to a rare external host with a rare domain public suffix
  • [Low] Uncommon process communication to a rare external host with an external IP in the command line
  • [Low] Uncommon process communication to a rare external host with global anomaly detection
• [Low] GCP IAM deny policy creation

  • [Medium] Unusual GCP IAM deny policy creation
• [Low] GCP sensitive role granted to group

  • [Medium] GCP sensitive role granted to group
• [Low] Mount command was executed from within a Kubernetes pod to list all the attached filesystems

  • [Medium] Unusual mount command was executed from within a Kubernetes pod to list all the attached filesystems
• [Informational] VPN Login Password Spray

  • [Medium] Successful VPN Password Spray Threat Detected with unusual characteristics
  • [Low] VPN login password spray with unusual characteristics
• [Informational] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server

  • [Low] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server where both the User Agent and the HTTP Server are rare
• [Informational] Access to Kubernetes CA certificate file

  • [Low] Access to Kubernetes CA certificate file by an unusual process
• [Informational] Access to kubelet credentials file

  • [Low] Access to kubelet credentials file by an unusual process
• [Low] An executable was written and executed by a web server
• [Informational] Local group enumeration

  • [Low] Local group enumeration for the first time
  • [Low] Local group enumeration using a builtin Windows binary
• [Informational] Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server

  • [Low] Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server using a vulnerable package
• [Informational] Retrieval of kubelet credentials

  • [Low] Retrieval of kubelet credentials by an unusual process
• [Informational] SES Production Access Requested

  • [Low] SES Production Access Requested by an unusual identity
• [Low] Suspicious activity on logging bucket
• [Informational] Unusual display name in From header

  • [Low] Unusual display name in the From header containing an embedded URL
  • [Informational] Unusual display name in the From header that is identical to the email address
• [Informational] GCP service account impersonation attempt
• [Informational] Local user account creation by a machine account
• [Informational] Unusual user-agent for a cloud identity
• [Informational] Well-known brand in sender headers with header inconsistencies

Removed

• [Informational] Unusual resource modification/creation

  • [Low] Unusual resource modification/creation by newly seen user
  • [Informational] Unusual resource modification/creation by an identity with high administrative activity

Modified Logic

• [High] A Successful VPN connection from TOR
• [High] A Successful login from TOR
• [High] A successful SSO sign-in from TOR
• [High] Bronze-Bit exploit
• [High] Copy a process memory file
• [Medium -> High] Hydra Password Brute-Force Tool Execution

  • [Medium -> High] Hydra Password Brute-Force Tool Execution from a Kubernetes pod - Modified Metadata
• [High] Memory dumping with comsvcs.dll
• [High] Mimikatz command-line arguments
• [High] Netcat makes or gets connections
• [High] Possible Distributed File System Namespace Management (DFSNM) abuse
• [High] Possible brute force or configuration change attempt on cytool
• [High] PowerShell used to remove mailbox export request logs
• [High] Remote service command execution from an uncommon source
• [Low] Remote usage of an AWS service token

  • [High] Remote usage of an AWS EKS token - Temporarily Removed
  • [High] Suspicious usage of AWS service token - Temporarily Removed
  • [High] Suspicious usage of an AWS ECS token - Temporarily Removed
  • [Low] Remote usage of an AWS ECS token - Temporarily Removed
  • [Low] Suspicious usage of an AWS EKS token - Temporarily Removed
• [High] Suspicious API call from a Tor exit node
• [High] Suspicious SaaS API call from a Tor exit node
• [High] Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
• [High] Suspicious objects encryption in an AWS bucket
• [High] Suspicious usage of File Server Remote VSS Protocol (FSRVP)
• [High] Unicode RTL Override Character
• [High] Wbadmin deleted files in quiet mode
• [Medium] A Kubernetes API operation was successfully invoked by an anonymous user
• [Medium] A Kubernetes dashboard service account was used outside the cluster
• [Medium] A Possible crypto miner was detected on a host
• [Medium] A TCP stream was created directly in a shell
• [Informational] A cloud identity executed an API call from an unusual country

  • [Medium] A suspicious cloud identity executed an API call from an unusual country - Added
• [Medium] A cloud storage object was copied to a foreign cloud account
• [Medium] A contained executable from a mounted share initiated a suspicious outbound network connection
• [Medium] A contained executable was executed by an unusual process
• [Medium] A contained process attempted to escape using the 'notify on release' feature
• [Medium] A machine certificate was issued with a mismatch
• [Medium] A mail forwarding rule was configured in Google Workspace
• [Medium] A new machine attempted Kerberos delegation
• [Medium] A process was executed with a command line obfuscated by Unicode character substitution
• [Medium] A suspicious executable with multiple file extensions was created
• [Informational] A user logged in to the AWS console for the first time

  • [Medium] A non-user identity logged in to the AWS console for the first time - Modified Logic
• [Informational] AWS CloudTrail modification

  • [Medium] AWS CloudTrail modification - Added
• [Medium] An internal Cloud resource performed port scan on external networks
• [Medium] Autorun.inf created in root C drive
• [Medium] Azure AD PIM alert disabled
• [Low] Azure account deletion by a non-standard account

  • [Medium] A suspicious Azure account deletion by a non-standard account - Modified Logic
• [Medium] Bitsadmin.exe persistence using command-line callback
• [Medium] Cloud snapshot of a database or storage instance was publicly shared
• [Medium] Commonly abused AutoIT script connects to an external domain
• [Medium] Discovery of misconfigured certificate templates using LDAP
• [Informational] EBS volume attachment attempt

  • [Medium] EBS volume attachment attempt for volume with sensitive data - Modified Metadata
  • [Informational] EBS volume attachment attempt using Cloud Formation or Terraform - Modified Metadata
• [Medium] Encoded information using Windows certificate management tool
• [Medium] Executable created to disk by lsass.exe
• [Informational] Executable moved to Windows system folder

  • [Medium] Rare executable moved to Windows system folder by rare causality actor - Modified Logic
• [Medium] Fodhelper.exe UAC bypass
• [Informational] GCP logging sink modification

  • [Medium] GCP logging sink modification - Added
• [Medium] Indirect command execution using the Program Compatibility Assistant
• [Medium] Kerberos Traffic from Non-Standard Process
• [Medium] Kerberos User Enumeration
• [Informational] Kubernetes secret enumeration activity

  • [Medium] Kubernetes secret describe activity from a Kubernetes Pod - Added
  • [Medium] Kubernetes secret value extraction activity from a Kubernetes pod - Added
  • [Low] Kubernetes secret enumeration activity from a host - Added
  • [Informational] Kubernetes secret value extraction activity - Added
• [Medium] Kubernetes vulnerability scanner activity
• [Medium] Kubernetes vulnerability scanning tool usage
• [Medium] LSASS dump file written to disk
• [Medium] Logging was impaired via external encryption key
• [Medium] Machine account was added to a domain admins group
• [Medium] Mailbox Client Access Setting (CAS) changed
• [Medium] Manipulation of netsh helper DLLs Registry keys
• [Medium] Microsoft Office Process Spawning a Suspicious One-Liner
• [Medium] NTLM Hash Harvesting
• [Medium] New Administrative Behavior
• [Medium] Penetration testing tool activity
• [Medium] Phantom DLL Loading
• [Medium] Possible Persistence via group policy Registry keys
• [Medium] Possible RDP session hijacking using tscon.exe
• [Medium] Possible Search For Password Files
• [Medium] Possible code downloading from a remote host by Regsvr32
• [Medium] Possible collection of screen captures with Windows Problem Steps Recorder
• [Medium] Possible compromised machine account
• [Medium] Possible malicious .NET compilation started by a commonly abused process
• [Medium] Possible new DHCP server
• [Medium] PowerShell suspicious flags
• [Medium] PowerShell used to export mailbox contents
• [Medium] Procdump executed from an atypical directory
• [Medium] RDP Connection to localhost
• [Medium] Random-Looking Domain Names
• [Low -> Informational] Rare scheduled task created

  • [Medium] Uncommon remote scheduled task created - Modified Logic
  • [Low] Highly rare scheduled task created - Added
  • [Low] Uncommon local scheduled task created - Modified Logic
• [Medium] Remote WMI process execution
• [Low] Risk indicators detected in email

  • [Medium] Potential Brand Impersonation has been detected - Modified Logic
  • [Medium] Potential Business Email Compromise has been detected - Modified Logic
  • [Medium] Potential Phishing has been detected - Modified Logic
  • [Medium] Potential Spear Phishing has been detected - Modified Logic
• [Medium] Rundll32.exe running with no command-line arguments
• [Medium] Rundll32.exe spawns conhost.exe
• [Medium] Script file added to startup-related Registry keys
• [Medium] Service ticket request with a spoofed sAMAccountName
• [Medium] Sudoedit Brute force attempt
• [Medium] Suspicious .NET process loads an MSBuild DLL
• [Medium] Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
• [Medium] Suspicious HTTP parameters detected
• [Medium] Suspicious Kubernetes pod token access
• [Medium] Suspicious PowerSploit's recon module (PowerView) net function was executed
• [Medium] Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
• [Medium] Suspicious Process Spawned by wininit.exe
• [Medium] Suspicious SearchProtocolHost.exe parent process
• [Medium] Suspicious authentication package registered
• [Medium] Suspicious authentication with Azure Password Hash Sync user
• [Medium] Suspicious certutil command line
• [Medium] Suspicious dNSHostName attribute change to DC name
• [Medium] Suspicious disablement of the Windows Firewall using PowerShell commands
• [Medium] Suspicious heavy allocation of compute resources - possible mining activity
• [Medium] Suspicious hidden user created
• [Medium] Suspicious print processor registered
• [Medium] Suspicious time provider registered
• [Medium -> Low] Suspicious usage of EC2 token

  • [High -> Medium] Suspicious usage of EC2 token - Modified Logic
  • [Informational] Suspicious usage of EC2 token - Removed
• [Medium] TGT request with a spoofed sAMAccountName - Event log
• [Medium] TGT request with a spoofed sAMAccountName - Network
• [Medium] The CA policy EditFlags was queried
• [Medium] Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
• [Medium] Uncommon Service Create/Config
• [Medium] Uncommon SetWindowsHookEx API invocation of a possible keylogger
• [Medium] Uncommon jsp file write by a Java process
• [Low] Unsigned process creates a scheduled task via file access

  • [Medium] Unsigned process creates a scheduled task via file access on a sensitive server - Modified Metadata
• [Medium] Unsigned process injecting into a Windows system binary with no command line
• [Informational] Unusual cloud identity impersonation

  • [Medium] Suspicious cloud identity impersonation was succeeded - Modified Logic
  • [Informational] Suspicious cloud identity impersonation was failed - Modified Logic
• [Medium] Unusual process access to ld.so.preload file
• [Medium] Windows Installer exploitation for local privilege escalation
• [Medium] Windows LOLBIN executable connected to a rare external host
• [Low] A Backup vault policy was modified
• [Low] A Command Line Interface (CLI) command was executed from a GCP serverless compute service
• [Low] A Command Line Interface (CLI) command was executed from an AWS serverless compute service
• [Low] A GCP service account was delegated domain-wide authority in Google Workspace
• [Low] A cloud function was created with an unusual runtime
• [Low] A commonly abused process connected to a rare cloud resource
• [Low] A commonly abused process connected to a rare external host
• [Low] A compiled HTML help file wrote a script file to the disk
• [Low] A computer account was promoted to DC
• [Low] A disabled user attempted to log in to a VPN
• [Low] A domain was added to the trusted domains list
• [Low] A process queried the ADFS database decryption key via LDAP
• [Low] A rare FTP user has been detected on an existing FTP server
• [Low] A rare file path was added to the AppInit_DLLs registry value
• [Low] A remote service was created via RPC over SMB
• [Low] A suspicious direct syscall was executed
• [Low] A suspicious process enrolled for a certificate
• [Low] A user attempted to bypass Okta MFA
• [Low] A user connected a new USB storage device to multiple hosts
• [Low] A user modified the CA audit policy
• [Low] A user rejected an SSO request from an unusual country
• [Low] A user sent multiple TGT requests to irregular service
• [Low] A user uploaded malware to SharePoint or OneDrive
• [Low] AWS Guard-Duty detector deletion
• [Low] AWS S3 bucket was exposed to public access
• [Low] AWS data asset shared public
• [Low] AWS web ACL deletion
• [Low] Abnormal ICMP echo (PING) to multiple hosts
• [Low] Abnormal RPC traffic to multiple hosts
• [Low] Abnormal SMB activity to multiple hosts
• [Low] Abnormal communication with a rare combination of TLS and HTTP User Agent
• [Low] Abnormal network communication through TOR using an uncommon port
• [Low] Abnormal sensitive RPC traffic to multiple hosts
• [Low] Account probing
• [Low] An Azure Firewall policy deletion
• [Low] An RDS snapshot was exported to an unknown S3 bucket
• [Low] An S3 replication policy to an unknown bucket was created
• [Low] An uncommon executable was remotely written over SMB to an uncommon destination
• [Low] An uncommon service was started
• [Low] An unpopular process accessed the microphone on the host
• [Low] Attempt to execute a command on a remote host using PsExec.exe
• [Low] Authentication attempt by a honey user
• [Low] Azure AD PIM role settings change
• [Low] Azure Event Hub Deletion
• [Low] Azure Network Watcher Deletion
• [Low] Azure domain federation settings modification attempt
• [Low] Billing admin role was removed
• [Low] Cached credentials discovery with cmdkey
• [Low] Certutil pfx parsing
• [Low] Change of sudo caching configuration
• [Low] ClickFix - PowerShell executed through the run application
• [Informational] Cloud compute instance user data script modification

  • [Low] Unusual Cloud compute instance user data script modification - Modified Metadata
• [Low] Command running with COMSPEC in the command line argument
• [Low] Compressing data using python
• [Low] Conditional Access policy removed
• [Low] Conhost.exe spawned a suspicious cmd process
• [Low] Contained process execution with a rare GitHub URL
• [Low] Copy a user's GnuPG directory with rsync
• [Low] DNS Tunneling
• [Low] Delayed Deletion of Files
• [Low] Disable encryption operations
• [Low] Discovery of accounts with pre-authentication disabled via LDAP
• [Low] Download a script using the python requests module
• [Low] Elevation to SYSTEM via services
• [Low] Email attachment with Right-to-Left Override Unicode character
• [Low] Email was received from an unknown sender using a disposable domain
• [Low] Excessive user account lockouts
• [Low] Exchange DKIM signing configuration disabled
• [Low] Exchange Safe Attachment policy disabled or removed
• [Low] Exchange Safe Link policy disabled or removed
• [Low] Exchange anti-phish policy disabled or removed
• [Low] Exchange audit log disabled
• [Low] Exchange mailbox audit bypass
• [Low] Exchange malware filter policy removed
• [Low] Exchange transport forwarding rule configured
• [Low] Exchange user mailbox forwarding
• [Low] Executable or Script file written by a web server process
• [Low] Execution of an uncommon process at an early startup stage by Windows system binary
• [Low] Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary
• [Low] Execution of dllhost.exe with an empty command line
• [Informational] External user created a Microsoft Teams conversation with suspicious operations

  • [Informational -> Low] An external user created a chat and shortly after sent a link with a newly seen domain name - Modified Metadata
  • [Informational -> Low] An external user created a chat then sent a link with a file for the first time via Microsoft Teams - Modified Metadata
  • [Informational -> Low] An external user created a chat with a suspicious user or chat name and then sent a link via Microsoft Teams - Modified Metadata
  • [Informational -> Low] An external user initiated a Microsoft Teams chat in which a link was shared and a member was removed - Modified Metadata
  • [Informational -> Low] An external user initiated a Microsoft Teams chat in which a suspicious link was shared and a member was removed - Modified Metadata
  • [Informational -> Low] External user created a Microsoft Teams conversation with a suspicious user or chat name and shortly after removed a user from it - Modified Metadata
• [Low] Extracting credentials from Unix files
• [Low] FTP Connection Using an Anonymous Login or Default Credentials
• [Low] Failed Connections
• [Low] Failed DNS
• [Low] First Azure AD PowerShell operation for a user
• [Low] GCP data asset shared public
• [Low] Globally uncommon root domain from a signed process
• [Low] Globally uncommon root-domain port combination from a signed process
• [Low] HTTP with suspicious characteristics
• [Low] Image file execution options (IFEO) registry key set
• [Low] Impossible traveler - SSO
• [Low] Impossible traveler - VPN
• [Low] Installation of a new System-V service
• [Medium -> Low] Interactive at.exe privilege escalation method
• [Low] Interactive local account enumeration
• [Low] Interactive login by a service account
• [Low] Kerberos Pre-Auth Failures by Host
• [Low] Keylogging using system commands
• [Low] Known service display name with uncommon image-path
• [Low] Known service name with an uncommon image-path
• [Low] Kubernetes pod creation from unknown container image registry
• [Low] LDAP AD CS Enumeration via Attack Tool
• [Low] LDAP search query from an unpopular and unsigned process
• [Low] LOLBIN process executed with a high integrity level
• [Low] Large Upload (FTP)
• [Low] Large Upload (Generic)
• [Low] Large Upload (HTTPS)
• [Low] Large Upload (SMTP)
• [Low] Linux system firewall was modified
• [Low] Login attempt by a honey user
• [Low] Logs were not collected from a data source for an abnormally long time
• [Low] MFA Disabled for Google Workspace
• [Low] MFA was disabled for an Azure identity
• [Low] Masquerading as a default local account
• [Low] Masquerading as the Linux crond process
• [Low] Microsoft 365 storage services exfiltration activity
• [Low] Microsoft Office adds a value to autostart Registry key
• [Low] Microsoft Office injects code into a process
• [Low] Microsoft Office process spawns a commonly abused process
• [Low] Modification of NTLM restrictions in the Registry
• [Low] MpCmdRun.exe was used to download files into the system
• [Low] Mshta.exe launched with suspicious arguments
• [Low] Mshta.exe spawns from a browser process
• [Low] Multiple Azure AD admin role removals
• [Low] Multiple Rare LOLBIN Process Executions by User
• [Low] Multiple Suspicious FTP Login Attempts
• [Low] Multiple Weakly-Encrypted Kerberos Tickets Received
• [Low] Multiple discovery commands
• [Low] Multiple discovery commands on a Windows host by the same process
• [Low] Multiple suspicious user accounts were created
• [Low] Multiple uncommon SSH Servers with the same Server host key
• [Low] Multiple user accounts failed login due to account lockouts
• [Low] NTDS.dit file written by an uncommon executable
• [Low] NTLM Brute Force on a Service Account
• [Low] NTLM Brute Force on an Administrator Account
• [Low] New FTP Server
• [Low] New Shared User Account
• [Low] New addition to Windows Defender exclusion list
• [Low] Non-browser access to a pastebin-like site
• [Low] Office process accessed an unusual .LNK file
• [Low] Office process spawned with suspicious command-line arguments
• [Low] Okta FastPass reported phishing attack suspected
• [Low] Okta Reported Attack Suspected
• [Low] Outlook files accessed by an unsigned process
• [Low] Possible DCSync from a non domain controller
• [Low] Possible DLL Search Order Hijacking
• [Low] Possible Kerberoasting without SPNs
• [Low] Possible Kerberos relay attack
• [Low] Possible Pass-the-Hash
• [Low] Possible external RDP Brute-Force
• [Low] Possible multistage attack in Microsoft Teams
• [Low] Possible network service discovery via command-line tool
• [Low] Possible network sniffing attempt via tcpdump or tshark
• [Low] Possible path traversal via HTTP request
• [Low] Possible webshell file written by a web server process
• [Low] Potential SCCM credential harvesting using WMI detected
• [Low] PowerShell Initiates a Network Connection to GitHub
• [Low] PowerShell runs suspicious base64-encoded commands
• [Low] RDP connections enabled remotely via Registry
• [Low] Rare LDAP enumeration
• [Low] Rare RDP session to a remote host
• [Low] Rare SMB session to a remote host
• [Low] Rare SSH Session
• [Low] Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
• [Low] Rare Windows Remote Management (WinRM) HTTP Activity
• [Low] Rare binary connected to a rare cloud resource
• [Low] Rare binary connected to a rare external host
• [Low] Rare communication over email ports to external email server by unsigned process
• [Low] Rare file transfer over SMB protocol
• [Low] Rare process created an SSH session to an uncommon cloud resource
• [Low] Rare process created an SSH session to an uncommon external host
• [Low] Rare process executed by an AppleScript
• [Low] Rare process with VNC server capabilities started
• [Low] Rare security product signed executable executed in the network
• [Low] Rare service DLL was added to the registry
• [Low] Reading bash command history file
• [Low] Recurring access to rare IP
• [Low] Recurring access to rare domain
• [Low] Recurring rare domain access from an unsigned process
• [Low] Recurring rare domain access to dynamic DNS domain
• [Low] Remote DCOM command execution
• [Low] Remote command execution via wmic.exe
• [Low] Remote service start from an uncommon source
• [Low] Remote usage of an Azure Managed Identity token
• [Low] Rundll32.exe executes a rare unsigned module
• [Low] SMB Traffic from Non-Standard Process
• [Low] SPNs cleared from a machine account
• [Low] SSO authentication attempt by a honey user
• [Low] SSO authentication by a machine account
• [Low] SSO authentication by a service account
• [Low] SUID/GUID permission discovery
• [Low] Scheduled Task hidden by registry modification
• [Low] Screensaver process executed from Users or temporary folder
• [Low] Scripting engine connected to a rare external host
• [Low] SecureBoot was disabled
• [Low] Sending unusual file(s) to an external address
• [Low] Sensitive browser credential files accessed by a rare non browser process
• [Low] Setuid and Setgid file bit manipulation
• [Low] Short-lived user account
• [Low] Spam Bot Traffic
• [Low] Stored credentials exported using credwiz.exe
• [Low] Subdomain Fuzzing
• [Low] Suspicious Certutil AD CS contact
• [Low] Suspicious DotNet log file created
• [Low] Suspicious ICMP packet
• [Low] Suspicious ICMP traffic that resembles smurf attack
• [Low] Suspicious LDAP search query executed
• [Low] Suspicious PowerShell Command Line
• [Low] Suspicious PowerShell Enumeration of Running Processes
• [Low] Suspicious Print System Remote Protocol usage by a process
• [Low] Suspicious Process Spawned by Adobe Reader
• [Low] Suspicious RunOnce Parent Process
• [Low] Suspicious SMB connection from domain controller
• [Low] Suspicious SSH Downgrade
• [Low] Suspicious Udev driver rule execution manipulation
• [Low] Suspicious access of the System Management Container
• [Low] Suspicious container orchestration job
• [Low] Suspicious data encryption
• [Low] Suspicious disablement of the Windows Firewall
• [Low] Suspicious failed HTTP request - potential Spring4Shell exploit
• [Low] Suspicious identity downloaded multiple objects from a bucket
• [Low] Suspicious modification of the AdminSDHolder's ACL
• [Low] Suspicious module load using direct syscall
• [Low] Suspicious process accessed certificate files
• [Low] Suspicious process modified RC script file
• [Low] Suspicious runonce.exe parent process
• [Low] Suspicious sAMAccountName change
• [Low] Suspicious setspn.exe execution
• [Low] Suspicious sshpass command execution
• [Low] Suspicious systemd timer activity
• [Low] Svchost.exe loads a rare unsigned module
• [Low] System information discovery via psinfo.exe
• [Low] The Linux system firewall was disabled
• [Low] Uncommon ARP cache listing via arp.exe
• [Low] Uncommon AT task-job creation by user
• [Low] Uncommon IP Configuration Listing via ipconfig.exe
• [Informational] Uncommon Launch Agent persistency was registered or modified

  • [Low] Uncommon Launch Agent persistency was registered or modified by a non validly signed process - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified by a tool with possible web access - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified by an unsigned process - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified while using a data communication tool - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified while using osascript - Modified Logic
  • [Low] Uncommon Launch Agent persistency was registered or modified with an uncommon path containing a known vendor name - Modified Metadata
  • [Low] Uncommon Launch Agent persistency was registered or modified with an unusual persistency executable path - Modified Metadata
• [Informational] Uncommon Launch Daemon persistency was registered or modified

  • [Low] Uncommon Launch Daemon persistency was registered or modified by a non validly signed process - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified by a tool with possible web access - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified by an unsigned process - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified while using a data communication tool - Modified Logic
  • [Low] Uncommon Launch Daemon persistency was registered or modified while using osascript - Modified Logic
  • [Low] Uncommon Launch Daemon persistency was registered or modified with an uncommon path containing a known vendor name - Modified Metadata
  • [Low] Uncommon Launch Daemon persistency was registered or modified with an unusual persistency executable path - Modified Metadata
• [Low] Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
• [Low] Uncommon PowerShell commands used to create or alter scheduled task parameters
• [Low] Uncommon SSH session was established
• [Low] Uncommon Security Support Provider (SSP) registered via a registry key
• [Low] Uncommon VNC server communication
• [Low] Uncommon access to Microsoft Teams credential files
• [Low] Uncommon attempt to clear shell history
• [Low] Uncommon creation or access operation of sensitive shadow copy
• [Low] Uncommon driver loaded
• [Low] Uncommon execution of ODBCConf
• [Low] Uncommon file access over WebDAV
• [Low] Uncommon local scheduled task creation via schtasks.exe
• [Low] Uncommon msiexec execution of an arbitrary file from a remote location
• [Low] Uncommon remote monitoring and management tool
• [Low] Uncommon remote scheduled task creation
• [Low] Uncommon remote service start via sc.exe
• [Low] Uncommon reverse SSH tunnel to external domain/ip
• [Low] Uncommon routing table listing via route.exe
• [Low] Uncommon sensitive registry hive dump
• [Low] Unprivileged process opened a registry hive
• [Low] Unsigned and unpopular process performed a DLL injection
• [Low] Unsigned and unpopular process performed an injection
• [Low] Unsigned process execution by scheduled task
• [Low] Unusual AWS credentials creation
• [Low] Unusual AWS user added to group
• [Low] Unusual Azure AD sync module load
• [Low] Unusual CIM repository file access
• [Low] Unusual CertLog Remote File Write
• [Low] Unusual Encrypting File System Remote call (EFSRPC) to domain controller
• [Low] Unusual Kubernetes API server communication from a pod
• [Low] Unusual Kubernetes dashboard communication from a pod
• [Low] Unusual Lolbins Process Spawned by InstallUtil.exe
• [Low] Unusual Netsh PortProxy rule
• [Low] Unusual Process Spawned by Nginx in Ingress-Nginx pod
• [Low] Unusual compressed file password protection
• [Low] Unusual cross projects activity
• [Low] Unusual process accessed FTP Client credentials
• [Low] Unusual process accessed a crypto wallet's files
• [Low] Unusual process accessed a messaging app's files
• [Low] Unusual process accessed a web browser history file
• [Informational] Unusual resource modification by newly seen IAM user

  • [Low] Unusual resource modification by newly seen IAM user from an uncommon IP - Modified Logic
• [Low] User added to the SMS Admins local group
• [Low] User collected remote shared files in an archive
• [Informational] User exported multiple messages in Microsoft Teams via Graph API

  • [Low] User exported multiple chats in Microsoft Teams via Graph API - Modified Logic
• [Low] User set insecure CA registry setting for global SANs
• [Low] VPN login attempt by a honey user
• [Low] VPN login by a service account
• [Low] Weakly-Encrypted Kerberos Ticket Requested
• [Low] Windows Event Log was cleared using wevtutil.exe
• [Low] Windows event logs were cleared with PowerShell
• [Low] WmiPrvSe.exe Rare Child Command Line
• [Low] Wscript/Cscript loads .NET DLLs
• [Low] Wsmprovhost.exe Rare Child Process
• [Informational] A Google Workspace Role privilege was deleted
• [Informational] A Google Workspace identity created, assigned or modified a role
• [Informational] A Google Workspace identity performed an unusual admin console activity
• [Informational] A Google Workspace identity used the security investigation tool
• [Informational] A Google Workspace service was configured as unrestricted
• [Informational] A Google Workspace user was added to a group
• [Informational] A Google Workspace user was removed from a group
• [Informational] A Kubernetes ConfigMap was created or deleted
• [Informational] A Kubernetes Cronjob was created
• [Informational] A Kubernetes DaemonSet was created
• [Informational] A Kubernetes Pod was created with a sidecar container
• [Informational] A Kubernetes Pod was deleted
• [Informational] A Kubernetes ReplicaSet was created
• [Informational] A Kubernetes StatefulSet was created
• [Informational] A Kubernetes cluster role binding was created or deleted
• [Informational] A Kubernetes cluster was created or deleted
• [Informational] A Kubernetes deployment was created
• [Informational] A Kubernetes ephemeral container was created
• [Informational] A Kubernetes namespace was created or deleted
• [Informational] A Kubernetes node service account activity from external IP
• [Informational] A Kubernetes role binding was created or deleted
• [Informational] A Kubernetes secret was created or deleted
• [Informational] A Kubernetes service account executed an unusual API call
• [Informational] A Kubernetes service account has enumerated its permissions
• [Informational] A Kubernetes service account was created or deleted
• [Informational] A Kubernetes service was created or deleted
• [Informational] A LOLBIN was copied to a different location
• [Informational] A Microsoft Teams application was installed
• [Informational] A Microsoft Teams bot was added to a team
• [Informational] A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment
• [Informational] A Service Principal was created in Azure
• [Informational] A Service Principal was removed from Azure
• [Informational] A Torrent client was detected on a host
• [Informational] A WMI subscriber was created
• [Informational] A browser extension was installed or loaded in an uncommon way
• [Informational] A browser was opened in private mode
• [Informational] A cloud identity created or modified a security group
• [Informational] A cloud identity had escalated its permissions
• [Informational] A cloud identity invoked IAM related persistence operations
• [Informational] A cloud identity started a Cloud Shell session
• [Informational] A cloud instance was stopped
• [Informational] A cloud snapshot of AWS database or storage was modified or shared
• [Informational] A cloud storage configuration was modified
• [Informational] A compressed file was exfiltrated over SSH
• [Informational] A compute-attached identity executed API calls outside the instance's region
• [Informational] A container registry was created or deleted
• [Informational] A disabled user attempted to authenticate via SSO
• [Informational] A disabled user attempted to log in
• [Informational] A new Azure email domain verification was requested
• [Informational] A non-browser process accessed a website UI
• [Informational] A possible risky login to Azure
• [Informational] A process connected to a rare cloud resource
• [Informational] A process connected to a rare external host
• [Informational] A process connected to rare external host
• [Informational] A process is masquerading as a common Microsoft product
• [Informational] A process modified an SSH authorized_keys file
• [Informational] A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process
• [Informational] A rare local administrator login
• [Informational] A service was disabled
• [Informational] A suspicious process queried AD CS objects via LDAP
• [Informational] A third-party application was authorized to access the Google Workspace APIs
• [Informational] A third-party application's access to the Google Workspace domain's resources was revoked
• [Informational] A third-party utility was copied to a different location
• [Informational] A user accessed Okta's admin application
• [Informational] A user accessed an abnormal number of files on a remote shared folder
• [Informational] A user accessed an abnormal number of remote shared folders
• [Informational] A user accessed an uncommon AppID
• [Informational] A user accessed multiple time-consuming websites
• [Informational] A user accessed multiple unusual resources via SSO
• [Informational] A user account was modified to password never expires
• [Informational] A user added a Windows firewall rule
• [Informational] A user authenticated with weak NTLM to multiple hosts
• [Informational] A user certificate was issued with a mismatch
• [Informational] A user changed the Windows system time
• [Informational] A user connected a USB storage device for the first time
• [Informational] A user connected a new USB storage device to a host
• [Informational] A user connected from a new country
• [Informational] A user connected to a VPN from a new country
• [Informational] A user created a pfx file for the first time
• [Informational] A user created an abnormal password-protected archive
• [Informational] A user enabled a default local account
• [Informational] A user established an SMB connection to multiple hosts
• [Informational] A user executed multiple LDAP enumeration queries
• [Informational] A user logged in at an unusual time via SSO
• [Informational] A user logged in at an unusual time via VPN
• [Informational] A user logged in from an abnormal country or ASN
• [Informational] A user logged on to multiple workstations via Schannel
• [Informational] A user modified an Okta network zone
• [Informational] A user modified an Okta policy rule
• [Informational] A user observed and reported unusual activity in Okta
• [Informational] A user performed suspiciously massive file activity
• [Informational] A user printed an unusual number of files
• [Informational] A user queried AD CS objects via LDAP
• [Informational] A user received multiple weakly encrypted service tickets
• [Informational] A user requested multiple service tickets
• [Informational] A user took numerous screenshots
• [Informational] A user was added to a Windows security group
• [Informational] AWS Backup recovery point deletion
• [Informational] AWS CloudTrail has been stopped
• [Informational] AWS CloudWatch log group deletion
• [Informational] AWS CloudWatch log stream deletion
• [Informational] AWS Config Recorder stopped
• [Informational] AWS EBS discovery operation
• [Informational] AWS EBS enumeration activity
• [Informational] AWS EBS snapshot deletion
• [Informational] AWS EC2 discovery operation
• [Informational] AWS EC2 infrastructure enumeration activity
• [Informational] AWS EC2 instance exported into S3
• [Informational] AWS Flow Logs deletion
• [Informational] AWS IAM account discovery operation
• [Informational] AWS IAM permission groups discovery operation
• [Informational] AWS IAM resource group deletion
• [Informational] AWS Lambda discovery operation
• [Informational] AWS Lambda infrastructure enumeration activity
• [Informational] AWS RDS cluster deletion
• [Informational] AWS S3 Buckets enumeration activity
• [Informational] AWS S3 discovery operation
• [Informational] AWS S3 object deletion
• [Informational] AWS SES account sending settings modified
• [Informational] AWS SSM parameters discovery
• [Informational] AWS SSM parameters retrieval
• [Informational] AWS SSM send command attempt
• [Informational] AWS STS temporary credentials were generated
• [Informational] AWS Secrets Manager Access
• [Informational] AWS Secrets Manager discovery
• [Informational] AWS SecurityHub findings were modified
• [Informational] AWS Storage Gateway enumeration
• [Informational] AWS Storage Gateway file share enumeration
• [Informational] AWS Transfer Family server created
• [Informational] AWS config resource deletion
• [Informational] AWS network ACL rule creation
• [Informational] AWS network ACL rule deletion
• [Informational] AWS root account activity
• [Informational] AWS user creation
• [Informational] Abnormal Allocation of compute resources in multiple regions
• [Informational] Abnormal Communication to a Rare Domain
• [Informational] Abnormal Communication to a Rare IP
• [Informational] Abnormal File Activity in SCCMContentLib Shared Folder by user
• [Informational] Abnormal RDP connections to multiple hosts
• [Informational] Abnormal Recurring Communications to a Rare Domain
• [Informational] Abnormal SMB scanning activity to multiple hosts
• [Informational] Abnormal User Login to Domain Controller
• [Informational] Abnormal connections to a dormant host from a newly seen endpoint
• [Informational] Abnormal process connection to default Meterpreter port
• [Informational] Access to Kubernetes configuration file
• [Informational] Activity in a dormant region of a cloud project
• [Informational] Adding execution privileges
• [Informational] Admin privileges were granted to a Google Workspace user
• [Informational] Administrator groups enumerated via LDAP
• [Informational] Allocation of multiple cloud compute resources
• [Informational] An AWS EFS File-share mount was deleted
• [Informational] An AWS EFS file-share was deleted
• [Informational] An AWS EKS cluster was created or deleted
• [Informational] An AWS GuardDuty IP set was created
• [Informational] An AWS Lambda Function was created
• [Informational] An AWS Lambda function was modified
• [Informational] An AWS RDS Global Cluster Deletion
• [Informational] An AWS RDS instance was created from a snapshot
• [Informational] An AWS Route 53 domain was transferred to another AWS account
• [Informational] An AWS S3 bucket configuration was modified
• [Informational] An AWS SAML provider was modified
• [Informational] An AWS SES identity was deleted
• [Informational] An AWS database service master user password was changed
• [Informational] An Azure DNS Zone was modified
• [Informational] An Azure Firewall rule collection group was modified or deleted
• [Informational] An Azure Firewall was modified
• [Informational] An Azure Key Vault key was modified
• [Informational] An Azure Key Vault was modified
• [Informational] An Azure Kubernetes Cluster was created or deleted
• [Informational] An Azure Kubernetes Role or Cluster-Role was modified
• [Informational] An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted
• [Informational] An Azure Kubernetes Service Account was modified or deleted
• [Informational] An Azure Network Security Group was modified
• [Informational] An Azure Point-to-Site VPN was modified
• [Informational] An Azure Suppression Rule was created
• [Informational] An Azure VPN Connection was modified
• [Informational] An Azure application reached a throttling API rate
• [Informational] An Azure firewall rule group was modified
• [Informational] An Azure identity performed multiple actions that were denied
• [Informational] An Azure virtual network Device was modified
• [Informational] An Azure virtual network was modified
• [Informational] An EBS snapshot block was downloaded
• [Informational] An Email address was added to AWS SES
• [Informational] An IAM group was created
• [Informational] An app was added to Google Marketplace
• [Informational] An app was added to the Google Workspace trusted OAuth apps list
• [Informational] An app was removed from a blocked list in Google Workspace
• [Informational] An identity accessed Azure Kubernetes Secrets
• [Informational] An identity accessed a backup cloud storage
• [Informational] An identity accessed a cloud storage for the first time
• [Informational] An identity accessed cloud storage containing sensitive data
• [Informational] An identity attached an administrative policy to an IAM user or role
• [Informational] An identity created or updated password for an IAM user
• [Informational] An identity disabled bucket logging
• [Informational] An identity initiated a download of multiple cloud objects
• [Informational] An identity performed a suspicious download of multiple cloud storage objects
• [Informational] An identity started an AWS SSM session
• [Informational] An identity was granted permissions to manage user access to Azure resources
• [Informational] An operation was performed by an identity from a domain that was not seen in the organization
• [Informational] An uncommon file added to startup-related Registry keys
• [Informational] An uncommon file was created in the startup folder
• [Informational] An unknown account was invited to the AWS organization
• [Informational] An unusual archive file creation by a user
• [Informational] An unusual cloud identity was granted permissions to a BigQuery resource
• [Informational] An unusual read activity of cloud object
• [Informational] AppleScript executed a shell script
• [Informational] AppleScript interpreter dynamic library loaded into a process
• [Informational] AppleScript process executed with a rare command line
• [Informational] Attempted Azure application access from unknown tenant
• [Informational] Aurora DB cluster stopped
• [Informational] Authentication Attempt From a Dormant Account
• [Informational] Authentication method added to an Azure account
• [Informational] Authentication method was added to Azure account
• [Informational] Azure AD PIM elevation request
• [Informational] Azure AD account unlock/password reset attempt
• [Informational] Azure Automation Account Creation
• [Informational] Azure Automation Runbook Creation/Modification
• [Informational] Azure Automation Runbook Deletion
• [Informational] Azure Automation Webhook creation
• [Informational] Azure Blob Container Access Level Modification
• [Informational] Azure Event Hub Authorization rule creation/modification
• [Informational] Azure Key Vault Secrets were modified
• [Informational] Azure Key Vault modification
• [Informational] Azure Kubernetes events were deleted
• [Informational] Azure Resource Group Deletion
• [Informational] Azure Service principal/Application creation
• [Informational] Azure Storage Account key generated
• [Informational] Azure Temporary Access Pass (TAP) registered to an account
• [Informational] Azure account creation by a non-standard account
• [Informational] Azure application URI modification
• [Informational] Azure application consent
• [Informational] Azure application credentials added
• [Informational] Azure application removed
• [Informational] Azure conditional access policy creation or modification
• [Informational] Azure device code authentication flow used
• [Informational] Azure diagnostic configuration deletion
• [Informational] Azure enumeration activity using Microsoft Graph API
• [Informational] Azure group creation/deletion
• [Informational] Azure mailbox rule creation
• [Informational] Azure permission delegation granted
• [Informational] Azure service principal assigned app role
• [Informational] Azure storage account blob anonymous access is enabled
• [Informational] Azure storage account cross-tenant object replication was enabled
• [Informational] Azure storage account was publicly shared
• [Informational] Azure uncommon increase in API request sizes
• [Informational] Azure user creation/deletion
• [Informational] Azure user password reset
• [Informational] Azure virtual machine commands execution
• [Informational] BigQuery table or query results exfiltrated to a foreign project
• [Informational] BitLocker key retrieval
• [Informational] Browser Extension Installed
• [Informational] Browser bookmark files accessed by a rare non-browser process
• [Informational] Brute-force attempt on a local account
• [Informational] Bucket's block public access setting turned off
• [Informational] Bucket's object ownership controls were modified
• [Informational] Cloud Organizational policy was created or modified
• [Informational] Cloud Watch alarm deletion
• [Informational] Cloud access key creation
• [Informational] Cloud compute serial console access
• [Informational] Cloud compute volume creation attempt
• [Informational] Cloud email infrastructure enumeration activity
• [Informational] Cloud email sending was enabled
• [Informational] Cloud email service activity
• [Informational] Cloud identity reached a throttling API rate
• [Informational] Cloud impersonation attempt by unusual identity type
• [Informational] Cloud infrastructure enumeration activity
• [Informational] Cloud instance creation attempt
• [Informational] Cloud instance deletion attempt
• [Informational] Cloud resource logging was disabled
• [Informational] Cloud snapshot created or modified
• [Informational] Cloud storage automatic backup disabled
• [Informational] Cloud storage delete protection disabled
• [Informational] Cloud storage object discovery
• [Informational] Cloud user performed multiple actions that were denied
• [Informational] CloudTrail logging deletion
• [Informational] Command execution in a Kubernetes pod
• [Informational] Command execution via wmiexec
• [Informational] Common third-party software name masquerading
• [Informational] Commonly abused AutoIT script drops an executable file to disk
• [Informational] Commonly abused process launched as a system service
• [Informational] Creation or modification of the default command executed when opening an application
• [Informational] Credentials were added to Azure application
• [Informational] DLP sensitive data exposed to external users
• [Informational] DSC (Desired State Configuration) lateral movement using PowerShell
• [Informational] Data Sharing between GCP and Google Workspace was disabled
• [Informational] Data encryption was disabled
• [Informational] Deletion of AD CS certificate database entries
• [Informational] Deletion of multiple cloud resources
• [Informational] Denied API call by a Kubernetes service account
• [Informational] Device Registration Policy modification
• [Informational] Discovery of host users via WMIC
• [Informational] Download pattern that resembles Peer to Peer traffic
• [Informational] EBS snapshots were created from an EC2 instance
• [Informational] EBS volume detachment attempt

  • [Informational] EBS volume detachment attempt using Cloud Formation or Terraform - Modified Metadata
• [Informational] EC2 instance Amazon machine image was created
• [Informational] EC2 snapshot attribute has been modified
• [Informational] Email attachment with a potentially malicious file extension
• [Informational] Email attachment with multiple extensions
• [Informational] Email attachment(s) with potentially malicious MIME type
• [Informational] Email containing a link with an IP address convention was detected
• [Informational] Email containing a redirected link
• [Informational] Email contains URL delivering high-risk file type
• [Informational] Email has a short body or subject and was sent from an external source
• [Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
• [Informational] Email mimics replies or forwards without an actual ongoing conversation
• [Informational] Email was received from an unknown address using a public provider domain
• [Informational] Email was received from an unknown sender using a recognized domain
• [Informational] Email with URL shortener detected
• [Informational] Email with file-sharing link containing auto-download parameter
• [Informational] Exchange compliance search created
• [Informational] Exchange email-hiding inbox rule
• [Informational] Exchange email-hiding transport rule
• [Informational] Exchange inbox forwarding rule configured
• [Informational] Exchange mailbox delegation permissions added
• [Informational] Exchange mailbox folder permission modification
• [Informational] Execution of an uncommon process at an early startup stage
• [Informational] Execution of an uncommon process with a local/domain user SID at an early startup stage
• [Informational] Execution of masqueraded third-party utility
• [Informational] Execution of renamed lolbin
• [Informational] External Login Password Spray
• [Informational] External SaaS file-sharing activity
• [Informational] External Sharing was turned on for Google Drive
• [Informational] External email display name impersonation of internal personnel
• [Informational] External email with a single internal recipient hidden in BCC
• [Informational] External user added a link to a Microsoft Teams chat
• [Informational] External user invitation to Azure tenant
• [Informational] External user started a Microsoft Teams conversation
• [Informational] Failed Login For Locked-Out Account
• [Informational] Failed Login For a Long Username With Special Characters
• [Informational] File transfer from unusual IP using known tools
• [Informational] First SSO Resource Access in the Organization
• [Informational] First SSO access from ASN for user
• [Informational] First SSO access from ASN in organization
• [Informational] First VPN access attempt from a country in organization
• [Informational] First VPN access from ASN for user
• [Informational] First VPN access from ASN in organization
• [Informational] First connection from a country in organization
• [Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
• [Informational] Foreign account was granted permissions to S3 bucket via resource-based policy
• [Informational] GCP Firewall Rule Modification
• [Informational] GCP Firewall Rule creation
• [Informational] GCP IAM Role Deletion
• [Informational] GCP IAM Service Account Key Deletion
• [Informational] GCP Logging Bucket Deletion
• [Informational] GCP Pub/Sub Subscription Deletion
• [Informational] GCP Pub/Sub Topic Deletion
• [Informational] GCP Service Account Disable
• [Informational] GCP Service Account creation
• [Informational] GCP Service Account deletion
• [Informational] GCP Service Account key creation
• [Informational] GCP Storage Bucket Configuration Modification
• [Informational] GCP Storage Bucket Permissions Modification
• [Informational] GCP Storage Bucket deletion
• [Informational] GCP VPC Firewall Rule Deletion
• [Informational] GCP Virtual Private Cloud (VPC) Network Deletion
• [Informational] GCP Virtual Private Network Route Creation
• [Informational] GCP Virtual Private Network Route Deletion
• [Informational] GCP administrative role granted to a cloud identity
• [Informational] GCP logging sink deletion
• [Informational] GCP sensitive Cloud Run role granted
• [Informational] GCP sensitive Deployment Manager role granted
• [Informational] GCP sensitive Functions role granted
• [Informational] GCP sensitive IAM role granted
• [Informational] GCP sensitive Secret Manager role granted
• [Informational] GCP sensitive compute role granted
• [Informational] GCP sensitive storage role granted
• [Informational] GCP set IAM policy activity
• [Informational] Globally uncommon IP address by a common process (sha256)
• [Informational] Globally uncommon IP address connection from a signed process
• [Informational] Globally uncommon high entropy module was loaded
• [Informational] Globally uncommon high entropy process was executed
• [Informational] Globally uncommon image load from a signed process
• [Informational] Globally uncommon injection from a signed process
• [Informational] Globally uncommon process execution from a signed process
• [Informational] Globally uncommon root-domain port combination by a common process (sha256)
• [Informational] Gmail delegation was turned on for the organization
• [Informational] Gmail routing settings changed
• [Informational] Google Marketplace restrictions were modified
• [Informational] Google Workspace organizational unit was modified
• [Informational] Google Workspace third-party application's security settings were changed
• [Informational] Granting Access to an Account
• [Informational] Hidden Attribute was added to a file using attrib.exe
• [Informational] IAM Enumeration sequence
• [Informational] IAM User added to an IAM group
• [Informational] IAM inline policy was added to group
• [Informational] IAM inline policy was added to role
• [Informational] IAM inline policy was added to user
• [Informational] IAM instance profile associations were described
• [Informational] IAM instance profile was associated with EC2 instance
• [Informational] IAM instance profile was created
• [Informational] IAM instance profile was replaced for EC2 instance
• [Informational] IAM instance profiles were listed
• [Informational] IAM policy default version was changed
• [Informational] IAM policy version was created
• [Informational] IAM policy was attached to group
• [Informational] IAM policy was attached to role
• [Informational] IAM role trust policy modification
• [Informational] IAM role was created
• [Informational] IAM role-attached managed policies were listed
• [Informational] IP Rotation Pattern in SSO Spray
• [Informational] Identity assigned an Azure AD Administrator Role
• [Informational] Increase in Job-Related Site Visits
• [Informational] Indicator blocking
• [Informational] Injection into rundll32.exe
• [Informational] Intense SSO failures
• [Informational] Interactive login by a machine account
• [Informational] Interactive login from a shared user account
• [Informational] Internal Login Password Spray
• [Informational] Iptables configuration command was executed
• [Informational] Kerberos Pre-Auth Failures by User and Host
• [Informational] Key credential attribute modification
• [Informational] Kubernetes Pod Created With Sensitive Volume
• [Informational] Kubernetes Pod Created with host Inter Process Communications (IPC) namespace
• [Informational] Kubernetes Pod created with host process ID (PID) namespace
• [Informational] Kubernetes Privileged Pod Creation
• [Informational] Kubernetes admission controller activity
• [Informational] Kubernetes cluster events deletion
• [Informational] Kubernetes enumeration activity
• [Informational] Kubernetes environment enumeration activity
• [Informational] Kubernetes network policy modification
• [Informational] Kubernetes nsenter container escape
• [Informational] Kubernetes pod creation with host network
• [Informational] Kubernetes service account activity outside the cluster
• [Informational] Kubernetes version disclosure
• [Informational] LDAP traffic from non-standard process
• [Informational] LOLBAS executable injects into another process
• [Informational] LOLBIN created a PSScriptPolicyTest PowerShell script file
• [Informational] Linux local user account creation
• [Informational] Linux network share discovery
• [Informational] Linux process execution with a rare GitHub URL
• [Informational] Local account discovery
• [Informational] Local group enumeration via RPC
• [Informational] Local user account creation
• [Informational] Local user enumeration via SAMR
• [Informational] Log enumeration via cloud native logging service
• [Informational] Login by a dormant user
• [Informational] MFA device was removed/deactivated from an IAM user
• [Informational] MSI accessed a web page running a server-side script
• [Informational] Mailbox enumeration activity by Azure application
• [Informational] Massive file activity abnormal to process
• [Informational] Massive file compression by user
• [Informational] Massive file downloads from SaaS service
• [Informational] Massive upload to SaaS service
• [Informational] Massive upload to a rare storage or mail domain
• [Informational] Member added to a Windows local security group
• [Informational] Microsoft 365 DLP policy disabled or removed
• [Informational] Microsoft Configuration Manager device registration and policy request
• [Informational] Microsoft OneDrive enumeration activity
• [Informational] Microsoft OneNote enumeration activity
• [Informational] Microsoft SharePoint enumeration activity
• [Informational] Microsoft Teams application setup policy was modified
• [Informational] Microsoft Teams enumeration activity
• [Informational] Microsoft Teams external communication policy was modified
• [Informational] Microsoft Teams messages were exported from conversation
• [Informational] Modification of PAM
• [Informational] Modification or Deletion of an Azure Application Gateway Detected
• [Informational] Moniker link detected in URL(s)
• [Informational] Msiexec execution of an executable from an uncommon remote location
• [Informational] Multi region enumeration activity
• [Informational] Multiple Okta MFA requests sent to a user
• [Informational] Multiple Rare Process Executions in Organization
• [Informational] Multiple TGT requests for users without Kerberos pre-authentication
• [Informational] Multiple cloud snapshots export
• [Informational] Multiple discovery commands on a Linux host by the same process
• [Informational] Multiple discovery-like commands
• [Informational] Multiple failed logins from a single IP
• [Informational] Multiple user accounts were deleted
• [Informational] Multiple users authenticated with weak NTLM to a host
• [Informational] NTLM Brute Force
• [Informational] NTLM Password Spray
• [Informational] NTLM Relay
• [Informational] Network sniffing detected in Cloud environment
• [Informational] New Teams application published to the organization catalog
• [Informational] New process created via a WMI call
• [Informational] Numerous emails sent by a single sender to multiple internal recipients
• [Informational] Object versioning was disabled
• [Informational] Okta API Token Created
• [Informational] Okta Reported Threat Detected
• [Informational] Okta User Session Impersonation
• [Informational] Okta account reset password attempt
• [Informational] Okta account unlock
• [Informational] Okta account unlock by admin
• [Informational] Okta admin privilege assignment
• [Informational] Okta device assignment
• [Informational] OneDrive file download
• [Informational] OneDrive file upload
• [Informational] OneDrive folder creation
• [Informational] Outbound email contains file-sharing service link sent to external recipient
• [Informational] Outbound email includes an external BCC recipient observed for the first time
• [Informational] Owner added to Azure application
• [Informational] Owner was added to Azure application
• [Informational] PIM privilege member removal
• [Informational] PKINIT TGT authentication request
• [Informational] Penetration testing tool activity attempt
• [Informational] Penetration testing tool attempt
• [Informational] Permission Groups discovery commands
• [Informational] Ping to localhost from an uncommon, unsigned parent process
• [Informational] Port Scan
• [Informational] Possible Brute-Force attempt
• [Informational] Possible DLL Hijack into a Microsoft process
• [Informational] Possible DLL Side-Loading
• [Informational] Possible Email collection using Outlook RPC
• [Informational] Possible GPO Enumeration
• [Informational] Possible IPFS traffic was detected
• [Informational] Possible Impossible Travel Pattern - SSO
• [Informational] Possible LDAP Enumeration Tool Usage
• [Informational] Possible LDAP Enumeration of Microsoft Configuration Manager
• [Informational] Possible LDAP enumeration by unsigned process
• [Informational] Possible Privilege Escalation using Delegated MSA account
• [Informational] Possible SPN enumeration
• [Informational] Possible TGT reuse from different hosts (pass the ticket)
• [Informational] Possible authentication coercion
• [Informational] Possible binary padding using dd
• [Informational] Possible brute force on sudo user
• [Informational] Possible data exfiltration over a USB storage device
• [Informational] Possible data obfuscation
• [Informational] Possible internal data exfiltration over a USB storage device
• [Informational] Possible use of IPFS was detected
• [Informational] Possible use of a networking driver for network sniffing
• [Informational] Potential DCSync by an unusual user
• [Informational] Potential NTLM Relay Attack
• [Informational] Potential Okta access limit breach
• [Informational] Potential creation of persistent cloud credentials
• [Informational] Potential spoofing of internal domain spotted
• [Informational] PowerShell pfx certificate extraction
• [Informational] Privileged certificate request via certificate template
• [Informational] Privileged role used by Azure application
• [Informational] PsExec was executed with a suspicious command line
• [Informational] Punycode characters detected in URL(s)
• [Informational] Python HTTP server started
• [Informational] Rare AppID usage to a rare destination
• [Informational] Rare DCOM RPC activity
• [Informational] Rare DLP rule match by user
• [Informational] Rare LOLBIN Process Execution by User
• [Informational] Rare MS-Update Server was detected
• [Informational] Rare MS-Update traffic over HTTP
• [Informational] Rare NTLM Access By User To Host
• [Informational] Rare NTLM Usage by User
• [Informational] Rare Remote Service (SVCCTL) RPC activity
• [Informational] Rare SMTP/S Session
• [Informational] Rare Scheduled Task RPC activity
• [Informational] Rare Unix process divided files by size
• [Informational] Rare WinRM Session
• [Informational] Rare access to known advertising domains
• [Informational] Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
• [Informational] Rare machine account creation
• [Informational] Rare process accessed a Keychain file
• [Informational] Rare process execution by user
• [Informational] Rare process execution in organization
• [Informational] Rare process spawned by srvany.exe
• [Informational] Rare signature signed executable executed in the network
• [Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
• [Informational] Registration of Uncommon .NET Services and/or Assemblies
• [Informational] Remote PsExec-like command execution
• [Informational] Remote account enumeration
• [Informational] Remote code execution into Kubernetes Pod
• [Informational] Remote usage of AWS Lambda's role
• [Informational] Remote usage of VM Service Account token
• [Informational] Remote usage of an App engine Service Account token
• [Informational] Remote usage of an Azure Service Principal token
• [Informational] Removal of an Azure Owner from an Application or Service Principal
• [Informational] Retrieval of cloud compute EC2 instance user data
• [Informational] Run downloaded script using pipe
• [Informational] S3 configuration deletion
• [Informational] SCCM log files enumeration
• [Informational] SSH authentication brute force attempts
• [Informational] SSO Brute Force
• [Informational] SSO Password Spray
• [Informational] SSO with abnormal operating system
• [Informational] SSO with abnormal user agent
• [Informational] SSO with new operating system
• [Informational] SaaS suspicious external domain user activity
• [Informational] Scrcons.exe Rare Child Process
• [Informational] Security tools detection attempt
• [Informational] Sensitive Exchange mail sent to external users
• [Informational] Sensitive account password reset attempt
• [Informational] Serial console access was enabled in AWS account
• [Informational] Service execution via sc.exe
• [Informational] SharePoint Site Collection admin group addition
• [Informational] Short-lived Azure AD user account
• [Informational] Signed process performed an unpopular DLL injection
• [Informational] Signed process performed an unpopular injection
• [Informational] Single account excessively locked out
• [Informational] Soft delete of cloud storage configuration was disabled
• [Informational] Space after filename
• [Informational] Storage enumeration activity
• [Informational] Successful unusual guest user invitation
• [Informational] Suspicious AMSI decode attempt
• [Informational] Suspicious Azure AD interactive sign-in using PowerShell
• [Informational] Suspicious DKIM Result
• [Informational] Suspicious DMARC result
• [Informational] Suspicious DNS traffic
• [Informational] Suspicious External RDP Login
• [Informational] Suspicious MFA request reported by user in Entra ID
• [Informational] Suspicious NTLM authentication with machine account
• [Informational] Suspicious SPF Result
• [Informational] Suspicious SSO access from ASN
• [Informational] Suspicious SSO authentication
• [Informational] Suspicious Unicode character detected in email
• [Informational] Suspicious access to cloud credential files
• [Informational] Suspicious access to shadow file
• [Informational] Suspicious active setup registered
• [Informational] Suspicious certificate template modification
• [Informational] Suspicious cloud compute instance SSH keys modification attempt
• [Informational] Suspicious container reconnaissance activity in a Kubernetes pod
• [Informational] Suspicious container runtime connection from within a Kubernetes Pod
• [Informational] Suspicious curl user agent
• [Informational] Suspicious docker image download from an unusual repository
• [Informational] Suspicious domain user account creation
• [Informational] Suspicious process accessed a site masquerading as Google
• [Informational] Suspicious process executed with a high integrity level
• [Informational] Suspicious process execution from tmp folder
• [Informational] Suspicious process execution in a privileged container
• [Informational] Suspicious process loads a known PowerShell module
• [Informational] Suspicious proxy environment variable setting
• [Informational] Suspicious reconnaissance using LDAP
• [Informational] Suspicious secrets dump activity
• [Informational] Suspicious successful RDP connection to localhost
• [Informational] Suspicious theme and sentiment in email
• [Informational] Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
• [Informational] System profiling WMI query execution
• [Informational] System shutdown or reboot
• [Informational] Tampering with Internet Explorer Protected Mode configuration
• [Informational] Tampering with the Windows User Account Controls (UAC) configuration
• [Informational] Uncommon DotNet module load relationship
• [Informational] Uncommon GetClipboardData API function invocation of a possible information stealer
• [Informational] Uncommon Linux remote shell command execution
• [Informational] Uncommon Linux shell command execution
• [Informational] Uncommon Managed Object Format (MOF) compiler usage
• [Informational] Uncommon RDP connection
• [Informational] Uncommon SQL like command line
• [Informational] Uncommon URL domain(s) in your organization detected in email
• [Informational] Uncommon WPAD queries
• [Informational] Uncommon access to cloud platforms' sensitive files by a scripting engine
• [Informational] Uncommon attempt at discovering a sensitive file
• [Informational] Uncommon attempt at grabbing credentials from a sensitive file
• [Informational] Uncommon browser extension loaded
• [Informational] Uncommon cloud CLI tool usage
• [Informational] Uncommon communication to an instant messaging server
• [Informational] Uncommon kernel module load
• [Informational] Uncommon macOS shell command execution
• [Informational] Uncommon net group command execution
• [Informational] Uncommon net localgroup command execution
• [Informational] Uncommon net localgroup execution
• [Informational] Uncommon network tunnel creation
• [Informational] Uncommon recurring rare external host access
• [Informational] Uncommon sensitive filesystem registry hive access
• [Informational] Uncommon service stop operation
• [Informational] Uncommon user management via net.exe
• [Informational] Unique client computer model was detected via MS-Update protocol
• [Informational] Unpopular URL(s) detected in email
• [Informational] Unpopular domains detected in email URLs for a recipient
• [Informational] Unpopular rsync process execution
• [Informational] Unrecognized internal address (AAD mismatch)
• [Informational] Unsigned DLL Hijack into a Microsoft process
• [Informational]