aws | Detection.FYI

cloudtrail

Jul 27, 2026 ·
Share on:

Read More

Recent Posts

Active Directory Replication from Non Machine Account - DcSync Indicator
ADCS - Certighost CDC Chase Certificate Request (CVE-2026-54121)
ADCS - Certighost Certificate Issued via CDC Chase (CVE-2026-54121)
ADCS - Certighost Ghost Machine Account Creation
Suspicious Machine Account Replication - DcSync Indicator
Suspicious Microsoft Office Child Process
Potentially Suspicious Explicit Credential Local Logon
Potentially Suspicious Image Load of Offreg.dll

Language

SIGMA 4108 ELASTIC 2058 MQL 1161

Tags

RESOURCES-INVESTIGATION-GUIDE 1982 USE-CASE-THREAT-DETECTION 1601 DOMAIN-ENDPOINT 1116 ATTACK.EXECUTION 1108 ATTACK.STEALTH 1036 DATA-SOURCE-ELASTIC-DEFEND 987 ATTACK.PERSISTENCE 866 ATTACK.PRIVILEGE-ESCALATION 743 OS-WINDOWS 569 DOMAIN-CLOUD 537 OS-LINUX 531 DATA-SOURCE-ELASTIC-ENDGAME 485 DETECTION.EMERGING-THREATS 471 TACTIC-DEFENSE-EVASION 463