2026.01.21

Release date: 01-February-2026

Summary

Added

19 Detectors: 3 Low, 16 Informational
27 Variations: 7 Medium, 16 Low, 4 Informational

Removed

2 Detectors: 1 Low, 1 Informational
1 Variation: 1 Informational

Modified Logic

705 Detectors: 18 High, 75 Medium, 245 Low, 367 Informational
24 Variations: 7 Medium, 12 Low, 5 Informational

Modified Metadata

2 Detectors: 1 Medium, 1 Informational

Added

[Informational] Access to sensitive host files from within a Kubernetes pod
- [Medium] Access to sensitive host files from within a Kubernetes pod via an interactive shell
- [Low] Unusual access to sensitive host files from within a Kubernetes pod
[Low] An identity successfully extracted multiple secrets within the organization
- [Medium] An identity successfully extracted multiple secrets within the organization across multiple regions
- [Medium] An unusual identity successfully extracted multiple secrets within the organization
[Informational] An uncommon RDP session was established
- [Medium] An uncommon RDP session was established from a Suspicious Autonomous System (AS)
- [Low] An uncommon RDP session was established between subnets with no prior communication
- [Low] An uncommon RDP session was established involving a destination subnet which rarely receives incoming RDP sessions
- [Low] An uncommon RDP session was established involving subnets with no prior RDP history
- [Low] An uncommon RDP session was established originating from a chained RDP session which is also from a rare subnet
[Low] Execution of command from within a Kubernetes pod using kubelet credentials
- [Medium] Unusual execution of command from within a Kubernetes pod using kubelet credentials
[Informational] Kubernetes API server communication from within a pod
- [Medium] Unusual Kubernetes API server communication from within a pod performed by curl process
- [Low] Unusual Kubernetes API server communication from within a pod
[Low] Suspicious EBS snapshots deletion
- [Medium] A non administrative identity successfully deleted multiple snapshots from a project
[Informational] A user modified an Okta MFA factor
- [Low] Abnormal Okta MFA Factor Authentication Modification
[Informational] An uncommon RDP session from a managed host
- [Low] An uncommon RDP session from a host that rarely initiates RDP
- [Low] An uncommon RDP session initiated by a chained RDP client
- [Low] An uncommon RDP session initiated by a globally rare RDP client
- [Low] An uncommon RDP session initiated by a process with rare causality
- [Low] An uncommon RDP session initiated by a rare RDP client
[Informational] RDP from an unmanaged endpoint in a typically managed subnet
- [Low] RDP from an unmanaged endpoint in a typically managed subnet with a significantly higher number of managed endpoints in the subnet
[Informational] Uncommon signed process execution by scheduled task
- [Low] Rare signed process execution by scheduled task
- [Low] Uncommon signed process execution by scheduled task on a sensitive server
- [Informational] Uncommon Microsoft signed process execution by scheduled task
[Informational] Windows CGO, actor and action processes with anomalous characteristics
- [Low] Windows CGO, actor and action processes with highly anomalous characteristics
[Informational] AWS Password Policy Discovery
[Informational] AWS principals discovery
[Informational] AWS resource discovery
[Informational] AWS support case creation
[Informational] An Azure SQL database was exported from a production subscription
[Informational] An Azure VM snapshot SAS URL was generated for export from a production subscription
[Informational] Outbound email to an address hosted by a public email service provider
- [Informational] Outbound email to a single address hosted by a public email service provider
[Informational] Sudden spike in outbound email volume
- [Informational] Sudden spike in outbound emails sent to external recipients
- [Informational] Sudden spike in outbound emails sent to internal recipients

Removed

[Low] Unusual Kubernetes API server communication from a pod
- [Informational] Unusual Kubernetes API server communication from a new pod
[Informational] Penetration testing tool attempt

Modified Logic

[High] A Successful VPN connection from TOR
[High] A Successful login from TOR
[High] A successful SSO sign-in from TOR
[High] Bronze-Bit exploit
[Medium -> High] Cloud penetration testing tool activity
- [Low] Cloud security assessment tool activity - Added
- [Informational] Cloud penetration testing tool activity by Azure application - Added
- [Informational] Cloud penetration testing tool usage attempt - Added
[High] Copy a process memory file
[High] Hydra Password Brute-Force Tool Execution
[High] Memory dumping with comsvcs.dll
[High] Mimikatz command-line arguments
[High] Netcat makes or gets connections
[High] Possible Distributed File System Namespace Management (DFSNM) abuse
[High] Possible brute force or configuration change attempt on cytool
[High] PowerShell used to remove mailbox export request logs
[High] Remote service command execution from an uncommon source
[High] Suspicious dump of ntds.dit using Shadow Copy with ntdsutil/vssadmin
[High] Suspicious usage of File Server Remote VSS Protocol (FSRVP)
[High] Unicode RTL Override Character
[High] Wbadmin deleted files in quiet mode
[Medium] A Possible crypto miner was detected on a host
[Medium] A TCP stream was created directly in a shell
[Medium] A contained executable from a mounted share initiated a suspicious outbound network connection
[Medium] A contained executable was executed by an unusual process
[Medium] A contained process attempted to escape using the 'notify on release' feature
[Medium] A machine certificate was issued with a mismatch
[Medium] A new machine attempted Kerberos delegation
[Medium] A process was executed with a command line obfuscated by Unicode character substitution
[Medium] A suspicious executable with multiple file extensions was created
[Medium] An internal Cloud resource performed port scan on external networks
[Medium] Autorun.inf created in root C drive
[Medium] Bitsadmin.exe persistence using command-line callback
[Informational] CloudTrail logging deletion
- [Medium] Successful CloudTrail logging deletion by a non-admin identity - Added
- [Low] Successful CloudTrail logging deletion by an unusual identity - Modified Metadata
[Medium] Commonly abused AutoIT script connects to an external domain
[Medium] Discovery of misconfigured certificate templates using LDAP
[Medium] Encoded information using Windows certificate management tool
[Medium] Executable created to disk by lsass.exe
[Medium] Fodhelper.exe UAC bypass
[Medium] Indirect command execution using the Program Compatibility Assistant
[Medium] Kerberos Traffic from Non-Standard Process
[Medium] Kerberos User Enumeration
[Medium] Kubernetes vulnerability scanner activity
[Low] LOLBIN process executed with a high integrity level
- [Medium] LOLBIN process executed with a high integrity level by a web server process or CGO - Modified Logic
[Medium] LSASS dump file written to disk
[Medium] Machine account was added to a domain admins group
[Medium] Mailbox Client Access Setting (CAS) changed
[Medium] Manipulation of netsh helper DLLs Registry keys
[Medium] Microsoft Office Process Spawning a Suspicious One-Liner
[Medium] NTLM Hash Harvesting
[Medium] New Administrative Behavior
[Medium] Phantom DLL Loading
[Medium] Possible Persistence via group policy Registry keys
[Medium] Possible RDP session hijacking using tscon.exe
[Medium] Possible Search For Password Files
[Medium] Possible code downloading from a remote host by Regsvr32
[Medium] Possible collection of screen captures with Windows Problem Steps Recorder
[Medium] Possible compromised machine account
[Medium] Possible malicious .NET compilation started by a commonly abused process
[Medium] Possible new DHCP server
[Medium] PowerShell suspicious flags
[Medium] PowerShell used to export mailbox contents
[Medium] Procdump executed from an atypical directory
[Medium] RDP Connection to localhost
[Medium] Random-Looking Domain Names
[Low] Rare unsigned process execution by scheduled task
- [Medium] Rare unsigned process execution by scheduled task on a sensitive server - Modified Metadata
- [Medium] Rare unsigned process execution with high integrity level by scheduled task - Added
- [Informational] Uncommon unsigned process execution by scheduled task - Added
[Medium] Remote WMI process execution
[Medium] Rundll32.exe running with no command-line arguments
[Medium] Rundll32.exe spawns conhost.exe
[Medium] Script file added to startup-related Registry keys
[Medium] Service ticket request with a spoofed sAMAccountName
[Medium] Sudoedit Brute force attempt
[Medium] Suspicious .NET process loads an MSBuild DLL
[Medium] Suspicious Encrypting File System Remote call (EFSRPC) to domain controller
[Medium] Suspicious HTTP parameters detected
[Medium] Suspicious Kubernetes pod token access
[Medium] Suspicious PowerSploit's recon module (PowerView) net function was executed
[Medium] Suspicious PowerSploit's recon module (PowerView) used to search for exposed hosts
[Medium] Suspicious Process Spawned by wininit.exe
[Medium] Suspicious SearchProtocolHost.exe parent process
[Medium] Suspicious authentication package registered
[Medium] Suspicious authentication with Azure Password Hash Sync user
[Medium] Suspicious certutil command line
[Medium] Suspicious dNSHostName attribute change to DC name
[Medium] Suspicious disablement of the Windows Firewall using PowerShell commands
[Medium] Suspicious hidden user created
[Medium] Suspicious print processor registered
[Medium] Suspicious time provider registered
[Medium] TGT request with a spoofed sAMAccountName - Event log
[Medium] TGT request with a spoofed sAMAccountName - Network
[Medium] The CA policy EditFlags was queried
[Medium] Uncommon DLL-sideloading from a logical CD-ROM (ISO) device
[Medium] Uncommon Service Create/Config
[Medium] Uncommon SetWindowsHookEx API invocation of a possible keylogger
[Low] Uncommon VNC server communication
- [Medium] Uncommon VNC scanning activity detected from a scanning tool - Modified Logic
[Medium] Uncommon jsp file write by a Java process
[Informational] Uncommon net localgroup command execution
- [Medium] Uncommon net localgroup administrators command execution by a web server process or CGO - Modified Logic
[Medium] Unsigned process injecting into a Windows system binary with no command line
[Informational] Unusual Kubernetes service account file read
- [Medium] Suspicious Kubernetes service account token read via an interactive shell - Added
[Medium] Unusual process access to ld.so.preload file
[Medium] Windows Installer exploitation for local privilege escalation
[Medium] Windows LOLBIN executable connected to a rare external host
[Informational] A browser extension was installed or loaded in an uncommon way
- [Low] A browser extension was installed or loaded in an uncommon way by a LOLBIN process - Modified Metadata
- [Low] A browser extension was installed or loaded in an uncommon way by an uncommon process - Modified Metadata
[Low] A commonly abused process connected to a rare cloud resource
[Low] A commonly abused process connected to a rare external host
[Low] A compiled HTML help file wrote a script file to the disk
[Low] A computer account was promoted to DC
[Low] A disabled user attempted to log in to a VPN
[Informational] A possible risky login to Azure
- [Informational -> Low] Azure Risky Login with Suspicious Characteristics - Modified Logic
- [Low] Azure-Defined High-Risk Login Attempt - Modified Logic
[Low] A process queried the ADFS database decryption key via LDAP
[Low] A rare FTP user has been detected on an existing FTP server
[Low] A rare file path was added to the AppInit_DLLs registry value
[Low] A remote service was created via RPC over SMB
[Low] A suspicious direct syscall was executed
[Low] A suspicious process enrolled for a certificate
[Low] A user connected a new USB storage device to multiple hosts
[Low] A user modified the CA audit policy
[Low] A user rejected an SSO request from an unusual country
[Low] A user sent multiple TGT requests to irregular service
[Low] Abnormal ICMP echo (PING) to multiple hosts
[Low] Abnormal RPC traffic to multiple hosts
[Low] Abnormal SMB activity to multiple hosts
[Low] Abnormal communication with a rare combination of TLS and HTTP User Agent
[Low] Abnormal network communication through TOR using an uncommon port
[Low] Abnormal sensitive RPC traffic to multiple hosts
[Low] Account probing
[Low] An uncommon executable was remotely written over SMB to an uncommon destination
[Low] An uncommon service was started
[Low] An unpopular process accessed the microphone on the host
[Low] Attempt to execute a command on a remote host using PsExec.exe
[Low] Authentication attempt by a honey user
[Low] Cached credentials discovery with cmdkey
[Low] Certutil pfx parsing
[Low] Change of sudo caching configuration
[Low] ClickFix - PowerShell executed through the run application
[Informational] Cloud snapshot created or modified
- [Low] Cloud snapshot was publicly shared - Modified Metadata
- [Low] Cloud snapshot was shared with an unusual AWS account(s) - Modified Metadata
- [Low] Previously unseen GCP principal was bound to cloud snapshot - Modified Metadata
[Low] Command running with COMSPEC in the command line argument
[Low] Compressing data using python
[Low] Conhost.exe spawned a suspicious cmd process
[Low] Contained process execution with a rare GitHub URL
[Low] Copy a user's GnuPG directory with rsync
[Low] DNS Tunneling
[Low] Delayed Deletion of Files
[Low] Discovery of accounts with pre-authentication disabled via LDAP
[Low] Download a script using the python requests module
[Low] Elevation to SYSTEM via services
[Informational] Email contains URL delivering high-risk file type
- [Low] External email with URL delivers blocked file types - Modified Logic
[Low] Email was received from an unknown sender using a disposable domain
[Low] Excessive user account lockouts
[Low] Executable or Script file written by a web server process
[Low] Execution of an uncommon process at an early startup stage by Windows system binary
[Low] Execution of an uncommon process with a local/domain user SID at an early startup stage by Windows system binary
[Low] Execution of dllhost.exe with an empty command line
[Low] Extracting credentials from Unix files
[Low] FTP Connection Using an Anonymous Login or Default Credentials
[Low] Failed Connections
[Low] Failed DNS
[Informational] Globally uncommon high entropy process was executed
- [Low] Globally uncommon high entropy process was executed by a web server process or CGO - Modified Logic
[Low] Globally uncommon root domain from a signed process
[Low] Globally uncommon root-domain port combination from a signed process
[Low] HTTP with suspicious characteristics
[Low] Image file execution options (IFEO) registry key set
[Low] Impossible traveler - SSO
[Low] Impossible traveler - VPN
[Low] Installation of a new System-V service
[Low] Interactive at.exe privilege escalation method
[Low] Interactive local account enumeration
[Low] Interactive login by a service account
[Low] Kerberos Pre-Auth Failures by Host
[Low] Keylogging using system commands
[Low] Known service display name with uncommon image-path
[Low] Known service name with an uncommon image-path
[Low] LDAP AD CS Enumeration via Attack Tool
[Low] LDAP search query from an unpopular and unsigned process
[Low] Large Upload (FTP)
[Low] Large Upload (Generic)
- [Informational] Large Upload (Generic)Lower than 100 MB - Removed
[Low] Large Upload (HTTPS)
[Low] Large Upload (SMTP)
[Low] Linux system firewall was modified
[Low] Login attempt by a honey user
[Low] Logs were not collected from a data source for an abnormally long time
[Low] Masquerading as a default local account
[Low] Masquerading as the Linux crond process
[Low] Microsoft Office adds a value to autostart Registry key
[Low] Microsoft Office injects code into a process
[Low] Microsoft Office process spawns a commonly abused process
[Low] Modification of NTLM restrictions in the Registry
[Low] Mount command was executed from within a Kubernetes pod to list all the attached filesystems
[Low] MpCmdRun.exe was used to download files into the system
[Low] Mshta.exe launched with suspicious arguments
[Low] Mshta.exe spawns from a browser process
[Low] Multiple Rare LOLBIN Process Executions by User
[Low] Multiple Suspicious FTP Login Attempts
[Low] Multiple Weakly-Encrypted Kerberos Tickets Received
[Low] Multiple discovery commands
[Low] Multiple discovery commands on a Windows host by the same process
[Low] Multiple suspicious user accounts were created
[Low] Multiple uncommon SSH Servers with the same Server host key
[Low] Multiple user accounts failed login due to account lockouts
[Low] NTDS.dit file written by an uncommon executable
[Low] NTLM Brute Force on a Service Account
[Low] NTLM Brute Force on an Administrator Account
[Low] New FTP Server
[Low] New Shared User Account
[Low] New addition to Windows Defender exclusion list
[Low] Non-browser access to a pastebin-like site
[Low] Office process accessed an unusual .LNK file
[Low] Office process spawned with suspicious command-line arguments
[Low] Okta FastPass reported phishing attack suspected
[Low] Outlook files accessed by an unsigned process
[Low] Possible DCSync from a non domain controller
[Low] Possible DLL Search Order Hijacking
[Low] Possible Kerberoasting without SPNs
[Low] Possible Kerberos relay attack
[Low] Possible Pass-the-Hash
[Low] Possible external RDP Brute-Force
[Low] Possible network service discovery via command-line tool
[Low] Possible network sniffing attempt via tcpdump or tshark
[Low] Possible path traversal via HTTP request
[Low] Possible webshell file written by a web server process
[Low] Potential SCCM credential harvesting using WMI detected
[Low] PowerShell Initiates a Network Connection to GitHub
[Low] PowerShell runs suspicious base64-encoded commands
[Low] RDP connections enabled remotely via Registry
[Low] Rare LDAP enumeration
[Low] Rare RDP session to a remote host
[Low] Rare SMB session to a remote host
[Low] Rare SSH Session
[Low] Rare Unsigned Process Spawned by Office Process Under Suspicious Directory
[Low] Rare Windows Remote Management (WinRM) HTTP Activity
[Low] Rare binary connected to a rare cloud resource
[Low] Rare binary connected to a rare external host
[Low] Rare communication over email ports to external email server by unsigned process
[Low] Rare file transfer over SMB protocol
[Low] Rare process created an SSH session to an uncommon cloud resource
[Low] Rare process created an SSH session to an uncommon external host
[Low] Rare process executed by an AppleScript
[Low] Rare process with VNC server capabilities started
[Low] Rare security product signed executable executed in the network
[Low] Rare service DLL was added to the registry
[Low] Reading bash command history file
[Low] Recurring access to rare IP
[Low] Recurring access to rare domain
[Low] Recurring rare domain access from an unsigned process
[Low] Recurring rare domain access to dynamic DNS domain
[Low] Remote DCOM command execution
[Low] Remote command execution via wmic.exe
[Low] Remote service start from an uncommon source
[Low] Risk indicators detected in email
[Low] Rundll32.exe executes a rare unsigned module
[Low] SMB Traffic from Non-Standard Process
[Low] SPNs cleared from a machine account
[Low] SSO authentication attempt by a honey user
[Low] SSO authentication by a machine account
[Low] SSO authentication by a service account
[Low] SUID/GUID permission discovery
[Low] Scheduled Task hidden by registry modification
[Low] Screensaver process executed from Users or temporary folder
[Low] Scripting engine connected to a rare external host
[Low] SecureBoot was disabled
[Low] Sending unusual file(s) to an external address
[Low] Sensitive browser credential files accessed by a rare non browser process
[Low] Setuid and Setgid file bit manipulation
[Low] Short-lived user account
[Low] Spam Bot Traffic
[Low] Stored credentials exported using credwiz.exe
[Low] Subdomain Fuzzing
[Low] Suspicious Certutil AD CS contact
[Low] Suspicious DotNet log file created
[Low] Suspicious ICMP packet
[Low] Suspicious ICMP traffic that resembles smurf attack
[Low] Suspicious LDAP search query executed
[Low] Suspicious PowerShell Command Line
[Low] Suspicious PowerShell Enumeration of Running Processes
[Low] Suspicious Print System Remote Protocol usage by a process
[Low] Suspicious Process Spawned by Adobe Reader
[Low] Suspicious RunOnce Parent Process
[Low] Suspicious SMB connection from domain controller
[Low] Suspicious SSH Downgrade
[Low] Suspicious Udev driver rule execution manipulation
[Low] Suspicious access of the System Management Container
[Low] Suspicious account attribute modification that matches that of another account
[Low] Suspicious container orchestration job
[Low] Suspicious data encryption
[Low] Suspicious disablement of the Windows Firewall
[Low] Suspicious failed HTTP request - potential Spring4Shell exploit
[Low] Suspicious modification of the AdminSDHolder's ACL
[Low] Suspicious module load using direct syscall
[Low] Suspicious process accessed certificate files
[Low] Suspicious process modified RC script file
[Low] Suspicious runonce.exe parent process
[Low] Suspicious sAMAccountName change
[Informational] Suspicious secrets dump activity
- [Low] An identity extracted multiple secrets within the organization across multiple regions - Modified Logic
[Low] Suspicious setspn.exe execution
[Low] Suspicious sshpass command execution
[Low] Suspicious systemd timer activity
[Low] Svchost.exe loads a rare unsigned module
[Low] System information discovery via psinfo.exe
[Low] The Linux system firewall was disabled
[Low] Uncommon ARP cache listing via arp.exe
[Low] Uncommon AT task-job creation by user
[Low] Uncommon IP Configuration Listing via ipconfig.exe
[Low] Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer
[Low] Uncommon PowerShell commands used to create or alter scheduled task parameters
[Low] Uncommon SSH session was established
[Low] Uncommon Security Support Provider (SSP) registered via a registry key
[Low] Uncommon access to Microsoft Teams credential files
[Low] Uncommon attempt to clear shell history
[Low] Uncommon creation or access operation of sensitive shadow copy
[Low] Uncommon driver loaded
[Low] Uncommon execution of ODBCConf
[Low] Uncommon file access over WebDAV
[Low] Uncommon local scheduled task creation via schtasks.exe
[Low] Uncommon msiexec execution of an arbitrary file from a remote location
[Low] Uncommon remote monitoring and management tool
[Low] Uncommon remote scheduled task creation
[Low] Uncommon remote service start via sc.exe
[Low] Uncommon reverse SSH tunnel to external domain/ip
[Low] Uncommon routing table listing via route.exe
[Low] Uncommon sensitive registry hive dump
[Low] Unprivileged process opened a registry hive
[Low] Unsigned and unpopular process performed a DLL injection
[Low] Unsigned and unpopular process performed an injection
[Low] Unsigned process creates a scheduled task via file access
[Low] Unusual AWS credentials creation
[Low] Unusual AWS user added to group
[Low] Unusual Azure AD sync module load
[Low] Unusual CIM repository file access
[Low] Unusual CertLog Remote File Write
[Low] Unusual Encrypting File System Remote call (EFSRPC) to domain controller
[Low] Unusual Kubernetes dashboard communication from a pod
[Low] Unusual Lolbins Process Spawned by InstallUtil.exe
[Low] Unusual Netsh PortProxy rule
[Low] Unusual Process Spawned by Nginx in Ingress-Nginx pod
[Low] Unusual compressed file password protection
[Low] Unusual process accessed FTP Client credentials
[Low] Unusual process accessed a crypto wallet's files
[Low] Unusual process accessed a messaging app's files
[Low] Unusual process accessed a web browser history file
[Low] User added to the SMS Admins local group
[Low] User collected remote shared files in an archive
[Low] User set insecure CA registry setting for global SANs
[Low] VPN login attempt by a honey user
[Low] VPN login by a service account
[Low] Weakly-Encrypted Kerberos Ticket Requested
[Low] Windows Event Log was cleared using wevtutil.exe
[Low] Windows event logs were cleared with PowerShell
[Low] WmiPrvSe.exe Rare Child Command Line
[Low] Wscript/Cscript loads .NET DLLs
[Low] Wsmprovhost.exe Rare Child Process
[Informational] A LOLBIN was copied to a different location
[Informational] A Torrent client was detected on a host
[Informational] A WMI subscriber was created
[Informational] A browser was opened in private mode
[Informational] A compressed file was exfiltrated over SSH
[Informational] A disabled user attempted to authenticate via SSO
[Informational] A disabled user attempted to log in
[Informational] A non-browser process accessed a website UI
[Informational] A process connected to a rare cloud resource
[Informational] A process connected to a rare external host
[Informational] A process connected to rare external host
[Informational] A process is masquerading as a common Microsoft product
[Informational] A process modified an SSH authorized_keys file
[Informational] A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process
[Informational] A rare local administrator login
[Informational] A service was disabled
[Informational] A suspicious process queried AD CS objects via LDAP
[Informational] A third-party utility was copied to a different location
[Informational] A user accessed an abnormal number of files on a remote shared folder
[Informational] A user accessed an abnormal number of remote shared folders
[Informational] A user accessed an uncommon AppID
[Informational] A user accessed multiple time-consuming websites
[Informational] A user accessed multiple unusual resources via SSO
[Informational] A user account was modified to password never expires
[Informational] A user added a Windows firewall rule
[Informational] A user authenticated with weak NTLM to multiple hosts
[Informational] A user certificate was issued with a mismatch
[Informational] A user changed the Windows system time
[Informational] A user connected a USB storage device for the first time
[Informational] A user connected a new USB storage device to a host
[Informational] A user connected from a new country
[Informational] A user connected to a VPN from a new country
[Informational] A user created a pfx file for the first time
[Informational] A user created an abnormal password-protected archive
[Informational] A user enabled a default local account
[Informational] A user established an SMB connection to multiple hosts
[Informational] A user executed multiple LDAP enumeration queries
[Informational] A user logged in at an unusual time via SSO
[Informational] A user logged in at an unusual time via VPN
[Informational] A user logged in from an abnormal country or ASN
[Informational] A user logged on to multiple workstations via Schannel
[Informational] A user performed suspiciously massive file activity
[Informational] A user printed an unusual number of files
[Informational] A user queried AD CS objects via LDAP
[Informational] A user received multiple weakly encrypted service tickets
[Informational] A user requested multiple service tickets
[Informational] A user took numerous screenshots
[Informational] A user was added to a Windows security group
[Informational] AWS Secrets Manager Access
[Informational] Abnormal Communication to a Rare Domain
[Informational] Abnormal File Activity in SCCMContentLib Shared Folder by user
[Informational] Abnormal RDP connections to multiple hosts
[Informational] Abnormal Recurring Communications to a Rare Domain
[Informational] Abnormal SMB scanning activity to multiple hosts
[Informational] Abnormal User Login to Domain Controller
[Informational] Abnormal connections to a dormant host from a newly seen endpoint
[Informational] Abnormal network communication with a rare combination of HTTP User Agent and HTTP Server
[Informational] Abnormal process connection to default Meterpreter port
[Informational] Access to Kubernetes CA certificate file
[Informational] Access to Kubernetes configuration file
[Informational] Access to kubelet credentials file
[Informational] Adding execution privileges
[Informational] Administrator groups enumerated via LDAP
[Informational] An uncommon file added to startup-related Registry keys
[Informational] An uncommon file was created in the startup folder
[Informational] An unusual archive file creation by a user
[Informational] An unusual read activity of cloud object
[Informational] AppleScript executed a shell script
[Informational] AppleScript interpreter dynamic library loaded into a process
[Informational] AppleScript process executed with a rare command line
[Informational] Authentication Attempt From a Dormant Account
[Informational] Browser Extension Installed
[Informational] Browser bookmark files accessed by a rare non-browser process
[Informational] Brute-force attempt on a local account
[Informational] Command execution in a Kubernetes pod
[Informational] Command execution via wmiexec
[Informational] Common third-party software name masquerading
[Informational] Commonly abused AutoIT script drops an executable file to disk
[Informational] Commonly abused process launched as a system service
[Informational] Creation or modification of the default command executed when opening an application
[Informational] DSC (Desired State Configuration) lateral movement using PowerShell
[Informational] Deletion of AD CS certificate database entries
[Informational] Discovery of host users via WMIC
[Informational] Download pattern that resembles Peer to Peer traffic
[Informational] Email attachment with a potentially malicious file extension
[Informational] Email attachment(s) with potentially malicious MIME type
[Informational] Email containing a link with an IP address convention was detected
[Informational] Email containing a redirected link
[Informational] Email has a short body or subject and was sent from an external source
[Informational] Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values
[Informational] Email mimics replies or forwards without an actual ongoing conversation
[Informational] Email was received from an unknown address using a public provider domain
[Informational] Email was received from an unknown sender using a recognized domain
[Informational] Email with URL shortener detected
[Informational] Email with file-sharing link containing auto-download parameter
[Informational] Executable moved to Windows system folder
[Informational] Execution of an uncommon process at an early startup stage
[Informational] Execution of an uncommon process with a local/domain user SID at an early startup stage
[Informational] Execution of masqueraded third-party utility
[Informational] Execution of renamed lolbin
[Informational] External Login Password Spray
[Informational] External email display name impersonation of internal personnel
[Informational] External email with a single internal recipient hidden in BCC
[Informational] Failed Login For Locked-Out Account
[Informational] Failed Login For a Long Username With Special Characters
[Informational] File transfer from unusual IP using known tools
[Informational] First SSO Resource Access in the Organization
[Informational] First SSO access from ASN for user
[Informational] First SSO access from ASN in organization
[Informational] First VPN access attempt from a country in organization
[Informational] First VPN access from ASN for user
[Informational] First VPN access from ASN in organization
[Informational] First connection from a country in organization
[Informational] First-seen email from mailbox owner to external recipient's address in the last 30 days
[Informational] Globally uncommon IP address by a common process (sha256)
[Informational] Globally uncommon IP address connection from a signed process
[Informational] Globally uncommon high entropy module was loaded
[Informational] Globally uncommon image load from a signed process
[Informational] Globally uncommon injection from a signed process
[Informational] Globally uncommon process execution from a signed process
[Informational] Globally uncommon root-domain port combination by a common process (sha256)
[Informational] Hidden Attribute was added to a file using attrib.exe
[Informational] IP Rotation Pattern in SSO Spray
[Informational] Increase in Job-Related Site Visits
[Informational] Indicator blocking
[Informational] Injection into rundll32.exe
[Informational] Intense SSO failures
[Informational] Interactive login by a machine account
[Informational] Interactive login from a shared user account
[Informational] Internal Login Password Spray
[Informational] Iptables configuration command was executed
[Informational] Kerberos Pre-Auth Failures by User and Host
[Informational] Key credential attribute modification
[Informational] Kubernetes environment enumeration activity
[Informational] Kubernetes nsenter container escape
[Informational] Kubernetes secret enumeration activity
[Informational] Kubernetes version disclosure
[Informational] LDAP traffic from non-standard process
[Informational] LOLBAS executable injects into another process
[Informational] LOLBIN created a PSScriptPolicyTest PowerShell script file
[Informational] Linux local user account creation
[Informational] Linux network share discovery
[Informational] Linux process execution with a rare GitHub URL
[Informational] Local account discovery
[Informational] Local group enumeration
[Informational] Local group enumeration via RPC
[Informational] Local user account creation
[Informational] Local user account creation by a machine account
[Informational] Local user enumeration via SAMR
[Informational] Login by a dormant user
[Informational] MSI accessed a web page running a server-side script
[Informational] Massive file activity abnormal to process
[Informational] Massive file compression by user
[Informational] Massive upload to a rare storage or mail domain
[Informational] Member added to a Windows local security group
[Informational] Microsoft Configuration Manager device registration and policy request
[Informational] Modification of PAM
[Informational] Msiexec execution of an executable from an uncommon remote location
[Informational] Multiple Okta MFA requests sent to a user
[Informational] Multiple Rare Process Executions in Organization
[Informational] Multiple TGT requests for users without Kerberos pre-authentication
[Informational] Multiple discovery commands on a Linux host by the same process
[Informational] Multiple discovery-like commands
[Informational] Multiple user accounts were deleted
[Informational] Multiple users authenticated with weak NTLM to a host
[Informational] NTLM Brute Force
[Informational] NTLM Password Spray
[Informational] NTLM Relay
[Informational] New process created via a WMI call
[Informational] Numerous emails sent by a single sender to multiple internal recipients
[Informational] Outbound email contains file-sharing service link sent to external recipient
[Informational] Outbound email includes an external BCC recipient observed for the first time
[Informational] PKINIT TGT authentication request
[Informational] Permission Groups discovery commands
[Informational] Ping to localhost from an uncommon, unsigned parent process
[Informational] Port Scan
[Informational] Possible Brute-Force attempt
[Informational] Possible DLL Hijack into a Microsoft process
[Informational] Possible Email collection using Outlook RPC
[Informational] Possible GPO Enumeration
[Informational] Possible IPFS traffic was detected
[Informational] Possible Impossible Travel Pattern - SSO
[Informational] Possible Kerberos User Enumeration
[Informational] Possible LDAP Enumeration Tool Usage
[Informational] Possible LDAP Enumeration of Microsoft Configuration Manager
[Informational] Possible LDAP enumeration by unsigned process
[Informational] Possible Privilege Escalation using Delegated MSA account
[Informational] Possible SPN enumeration
[Informational] Possible TGT reuse from different hosts (pass the ticket)
[Informational] Possible authentication coercion
[Informational] Possible binary padding using dd
[Informational] Possible brute force on sudo user
[Informational] Possible data exfiltration over a USB storage device
[Informational] Possible data obfuscation
[Informational] Possible internal data exfiltration over a USB storage device
[Informational] Possible use of IPFS was detected
[Informational] Possible use of a networking driver for network sniffing
[Informational] Potential DCSync by an unusual user
[Informational] Potential NTLM Relay Attack
[Informational] Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server
[Informational] Potential spoofing of internal domain spotted
[Informational] PowerShell pfx certificate extraction
[Informational] Privileged certificate request via certificate template
[Informational] PsExec was executed with a suspicious command line
[Informational] Punycode characters detected in URL(s)
[Informational] Python HTTP server started
[Informational] Rare AppID usage to a rare destination
[Informational] Rare DCOM RPC activity
[Informational] Rare LOLBIN Process Execution by User
[Informational] Rare MS-Update Server was detected
[Informational] Rare MS-Update traffic over HTTP
[Informational] Rare NTLM Access By User To Host
[Informational] Rare NTLM Usage by User
[Informational] Rare Remote Service (SVCCTL) RPC activity
[Informational] Rare SMTP/S Session
[Informational] Rare Scheduled Task RPC activity
[Informational] Rare Unix process divided files by size
[Informational] Rare WinRM Session
[Informational] Rare access to known advertising domains
[Informational] Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
[Informational] Rare machine account creation
[Informational] Rare process accessed a Keychain file
[Informational] Rare process execution by user
[Informational] Rare process execution in organization
[Informational] Rare process spawned by srvany.exe
[Informational] Rare scheduled task created
[Informational] Rare signature signed executable executed in the network
[Informational] Rarely seen URL(s) within a well-known domain detected in your organization's email
[Informational] Registration of Uncommon .NET Services and/or Assemblies
[Informational] Remote PsExec-like command execution
[Informational] Remote account enumeration
[Informational] Remote code execution into Kubernetes Pod
[Informational] Retrieval of kubelet credentials
[Informational] Run downloaded script using pipe
[Informational] SCCM log files enumeration
[Informational] SSH authentication brute force attempts
[Informational] SSO Brute Force
[Informational] SSO Password Spray
[Informational] SSO with abnormal operating system
[Informational] SSO with abnormal user agent
[Informational] SSO with new operating system
[Informational] Scrcons.exe Rare Child Process
[Informational] Security tools detection attempt
[Informational] Sensitive account password reset attempt
[Informational] Service execution via sc.exe
[Informational] Signed process performed an unpopular DLL injection
[Informational] Signed process performed an unpopular injection
[Informational] Single account excessively locked out
[Informational] Space after filename
[Informational] Suspicious AMSI decode attempt
[Informational] Suspicious Azure AD interactive sign-in using PowerShell
[Informational] Suspicious DKIM Result
[Informational] Suspicious DNS traffic
[Informational] Suspicious External RDP Login
[Informational] Suspicious NTLM authentication with machine account
[Informational] Suspicious SPF Result
[Informational] Suspicious SSO access from ASN
[Informational] Suspicious SSO authentication
[Informational] Suspicious Unicode character detected in email
[Informational] Suspicious access to cloud credential files
[Informational] Suspicious access to shadow file
[Informational] Suspicious active setup registered
[Informational] Suspicious certificate template modification
[Informational] Suspicious container reconnaissance activity in a Kubernetes pod
[Informational] Suspicious container runtime connection from within a Kubernetes Pod
[Informational] Suspicious curl user agent
[Informational] Suspicious docker image download from an unusual repository
[Informational] Suspicious domain user account creation
[Informational] Suspicious process accessed a site masquerading as Google
[Informational] Suspicious process executed with a high integrity level
[Informational] Suspicious process execution from tmp folder
[Informational] Suspicious process execution in a privileged container
[Informational] Suspicious process loads a known PowerShell module
[Informational] Suspicious proxy environment variable setting
[Informational] Suspicious reconnaissance using LDAP
[Informational] Suspicious successful RDP connection to localhost
[Informational] Suspicious usage of Microsoft's Active Directory PowerShell module remote discovery cmdlet
[Informational] System profiling WMI query execution
[Informational] System shutdown or reboot
[Informational] Tampering with Internet Explorer Protected Mode configuration
[Informational] Tampering with the Windows User Account Controls (UAC) configuration
[Informational] Uncommon DotNet module load relationship
[Informational] Uncommon GetClipboardData API function invocation of a possible information stealer
[Informational] Uncommon Launch Agent persistency was registered or modified
[Informational] Uncommon Launch Daemon persistency was registered or modified
[Informational] Uncommon Linux remote shell command execution
[Informational] Uncommon Linux shell command execution
[Informational] Uncommon Managed Object Format (MOF) compiler usage
[Informational] Uncommon RDP connection
[Informational] Uncommon SQL like command line
[Informational] Uncommon URL domain(s) in your organization detected in email
[Informational] Uncommon WPAD queries
[Informational] Uncommon access to cloud platforms' sensitive files by a scripting engine
[Informational] Uncommon attempt at discovering a sensitive file
[Informational] Uncommon attempt at grabbing credentials from a sensitive file
[Informational] Uncommon browser extension loaded
[Informational] Uncommon cloud CLI tool usage
[Informational] Uncommon communication to an instant messaging server
[Informational] Uncommon kernel module load
[Informational] Uncommon login item persistency was registered or modified
[Informational] Uncommon macOS shell command execution
[Informational] Uncommon net group command execution
[Informational] Uncommon net localgroup execution
[Informational] Uncommon network tunnel creation
[Informational] Uncommon process communication to a rare external host
[Informational] Uncommon recurring rare external host access
[Informational] Uncommon sensitive filesystem registry hive access
[Informational] Uncommon service stop operation
[Informational] Uncommon user management via net.exe
[Informational] Unique client computer model was detected via MS-Update protocol
[Informational] Unpopular URL(s) detected in email
[Informational] Unpopular domains detected in email URLs for a recipient
[Informational] Unpopular rsync process execution
[Informational] Unrecognized internal address (AAD mismatch)
[Informational] Unsigned DLL Hijack into a Microsoft process
[Informational] Unsigned DLL Side-Loading
[Informational] Unusual ADConnect database file access
[Informational] Unusual DB process spawning a shell
[Informational] Unusual SSH Activity
[Informational] Unusual SSH activity that resembles SSH proxy
[Informational] Unusual access to the AD Sync credential files
[Informational] Unusual access to the Windows Internal Database on an ADFS server
[Informational] Unusual attachment volume in outbound emails
[Informational] Unusual cloud Instance Metadata Service (IMDS) access
[Informational] Unusual display name in From header
[Informational] Unusual hostname for the sending mail server in the email headers
[Informational] Unusual process accessed a macOS notes DB file
[Informational] Unusual process accessed the PowerShell history file
[Informational] Unusual process accessed web browser cookies
[Informational] Unusual process accessed web browser credentials
[Informational] Unusual use of a 'SysInternals' tool
[Informational] Unusual user account enablement
[Informational] Unusual user account unlock
[Informational] Unusual weak authentication by user
[Informational] Upload pattern that resembles Peer to Peer traffic
[Informational] Usage of homograph characters detected in an email
[Informational] Usage of homograph characters detected in an email attachment(s) name
[Informational] Usage of homograph characters detected in an email's from header
[Informational] User account delegation change
[Informational] User added SID History to an account
[Informational] User added to a group and removed
[Informational] User and Group Enumeration via SAMR
[Informational] User attempted to connect from a suspicious country
[Informational] User discovery via WMI query execution
[Informational] User signed in to an application via Power Automate for the first time
[Informational] VM Detection attempt
[Informational] VM Detection attempt on Linux
[Informational] VPN Login Password Spray
[Informational] VPN access with an abnormal operating system
[Informational] VPN login Brute-Force attempt
[Informational] VPN login by a dormant user
[Informational] VPN login with a machine account
[Informational] Vulnerable certificate template loaded
[Informational] Weakly-Encrypted Kerberos TGT Response
[Informational] Web server CGO executed an uncommon process
[Informational] WebDAV drive mounted from net.exe over HTTPS
[Informational] Well-known brand in sender headers with header inconsistencies
[Informational] X-Forefront-Antispam-Report has flagged this email as a potential threat
- [Informational] X-Forefront-Antispam-Report flagged this email as spam - Modified Logic

Modified Metadata

[Medium] Correlation rule error
[Informational] Suspicious DMARC result

Previous2026.01.28

Next2026.01.07

Was this helpful?