attack.t1078.004

Account Disabled or Blocked for Sign in Attempts

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Detects when an account is disabled or blocked for sign in but tried to log in

Application AppID Uri Configuration Changes

Apr 28, 2026 · attack.initial-access attack.persistence attack.credential-access attack.privilege-escalation attack.stealth attack.t1552 attack.t1078.004 ·

Share on:

Detects when a configuration change is made to an applications AppID URI.

Application URI Configuration Changes

Apr 28, 2026 · attack.initial-access attack.stealth attack.t1528 attack.t1078.004 attack.persistence attack.credential-access attack.privilege-escalation ·

Share on:

Detects when a configuration change is made to an applications URI. URIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.

AWS IAM S3Browser LoginProfile Creation

Apr 28, 2026 · attack.execution attack.persistence attack.initial-access attack.privilege-escalation attack.stealth attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

AWS IAM S3Browser Templated S3 Bucket Policy Creation

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.009 attack.persistence attack.initial-access attack.privilege-escalation attack.t1078.004 ·

Share on:

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "".

AWS IAM S3Browser User or AccessKey Creation

Apr 28, 2026 · attack.privilege-escalation attack.execution attack.persistence attack.initial-access attack.stealth attack.t1059.009 attack.t1078.004 ·

Share on:

Detects S3 Browser utility creating IAM User or AccessKey.

AWS Root Credentials

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078.004 ·

Share on:

Detects AWS root account usage

AWS SAML Provider Deletion Activity

Apr 28, 2026 · attack.stealth attack.t1078.004 attack.privilege-escalation attack.initial-access attack.persistence attack.t1531 attack.impact ·

Share on:

Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.

AWS Successful Console Login Without MFA

Apr 28, 2026 · attack.initial-access attack.persistence attack.privilege-escalation attack.stealth attack.t1078.004 ·

Share on:

Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.

Azure AD Only Single Factor Authentication Required

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.defense-impairment attack.t1078.004 attack.t1556.006 ·

Share on:

Detect when users are authenticating without MFA being required.

Azure Subscription Permission Elevation Via ActivityLogs

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.

Bitbucket User Login Failure

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 ·

Share on:

Detects user authentication failure events. Please note that this rule can be noisy and it is recommended to use with correlation based on "author.name" field.

Bitlocker Key Retrieval

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Monitor and alert for Bitlocker key retrieval.

Changes To PIM Settings

Apr 28, 2026 · attack.initial-access attack.privilege-escalation attack.persistence attack.stealth attack.t1078.004 ·

Share on:

Detects when changes are made to PIM roles

Device Registration or Join Without MFA

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Monitor and alert for device registration or join events where MFA was not performed.

Failed Authentications From Countries You Do Not Operate Out Of

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 ·

Share on:

Detect failed authentications from countries you do not operate out of.

Github New Secret Created

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Detects when a user creates action secret for the organization, environment, codespaces or repository.

Github Self Hosted Runner Changes Detected

Apr 28, 2026 · attack.impact attack.discovery attack.collection attack.persistence attack.privilege-escalation attack.initial-access attack.stealth attack.t1526 attack.t1213.003 attack.t1078.004 ·

Share on:

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Github SSH Certificate Configuration Changed

Apr 28, 2026 · attack.initial-access attack.persistence attack.privilege-escalation attack.stealth attack.t1078.004 ·

Share on:

Detects when changes are made to the SSH certificate configuration of the organization.

Guest User Invited By Non Approved Inviters

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078.004 ·

Share on:

Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.

Login to Disabled Account

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Detect failed attempts to sign in to disabled accounts.

Multifactor Authentication Denied

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.

Multifactor Authentication Interrupted

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 attack.t1621 ·

Share on:

Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.

Okta New Admin Console Behaviours

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Detects when Okta identifies new activity in the Admin Console.

Password Reset By User Account

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.credential-access attack.stealth attack.t1078.004 ·

Share on:

Detect when a user has reset their password in Azure AD

PIM Approvals And Deny Elevation

Apr 28, 2026 · attack.persistence attack.initial-access attack.privilege-escalation attack.stealth attack.t1078.004 ·

Share on:

Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.

Potential MFA Bypass Using Legacy Client Authentication

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 ·

Share on:

Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.

Privileged Account Creation

Apr 28, 2026 · attack.initial-access attack.persistence attack.privilege-escalation attack.stealth attack.t1078.004 ·

Share on:

Detects when a new admin is created.

Sign-in Failure Due to Conditional Access Requirements Not Met

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1110 attack.t1078.004 ·

Share on:

Define a baseline threshold for failed sign-ins due to Conditional Access failures

Sign-ins by Unknown Devices

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.

Sign-ins from Non-Compliant Devices

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.stealth attack.t1078.004 ·

Share on:

Monitor and alert for sign-ins where the device was non-compliant.

Successful Authentications From Countries You Do Not Operate Out Of

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 ·

Share on:

Detect successful authentications from countries you do not operate out of.

Suspicious Login Activity Classified By Google

Apr 28, 2026 · attack.initial-access attack.privilege-escalation attack.persistence attack.stealth attack.t1078.004 ·

Share on:

Detects Google Workspace login activity that's classified as suspicious by Google.

Temporary Access Pass Added To An Account

Apr 28, 2026 · attack.privilege-escalation attack.initial-access attack.persistence attack.stealth attack.t1078.004 ·

Share on:

Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated

Use of Legacy Authentication Protocols

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.initial-access attack.credential-access attack.stealth attack.t1078.004 attack.t1110 ·

Share on:

Alert on when legacy authentication has been used on an account

User Access Blocked by Azure Conditional Access

Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.credential-access attack.initial-access attack.stealth attack.t1110 attack.t1078.004 ·

Share on:

Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.