Skip to content

ThreatHunting

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

ThreatHunting

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
Anomalous Azure Kubernetes Service Administrative Activity.md
Anomalous Azure Kubernetes Service Administrative Activity.md
 
 
Anomalous Increase in Unique Device Logon Count per User.md
Anomalous Increase in Unique Device Logon Count per User.md
 
 
Anomalous Kubernetes Service Account API Activity.md
Anomalous Kubernetes Service Account API Activity.md
 
 
Anomalous Windows Hello for Business Sign-In Without Device ID.md
Anomalous Windows Hello for Business Sign-In Without Device ID.md
 
 
Azure DevOps High Volume Activity via MCP Server.md
Azure DevOps High Volume Activity via MCP Server.md
 
 
Azure DevOps High Volume Search Activity.md
Azure DevOps High Volume Search Activity.md
 
 
Azure DevOps Token Administration Activity from Non-Corporate IP.md
Azure DevOps Token Administration Activity from Non-Corporate IP.md
 
 
Azure Key Vault Mass Secret Retrieval by Single Actor.md
Azure Key Vault Mass Secret Retrieval by Single Actor.md
 
 
Azure Kubernetes Service Pod Accessing Instance Metadata API.md
Azure Kubernetes Service Pod Accessing Instance Metadata API.md
 
 
Correlating LDAP Reconnaissance with Kerberoasting and Sensitive Queries.md
Correlating LDAP Reconnaissance with Kerberoasting and Sensitive Queries.md
 
 
Crypto-miner or Scanning Tool Execution in Kubernetes Container.md
Crypto-miner or Scanning Tool Execution in Kubernetes Container.md
 
 
High-Risk Vulnerabilities with Exploits Detected on Onboarded Devices.md
High-Risk Vulnerabilities with Exploits Detected on Onboarded Devices.md
 
 
Infostealer Browser Kill and Verify Sweep from Single Process.md
Infostealer Browser Kill and Verify Sweep from Single Process.md
 
 
Interactive Access to Kubernetes Pods by Unusual User.md
Interactive Access to Kubernetes Pods by Unusual User.md
 
 
Kerberos Ticket Request with Forwardable or Constrained Delegation Options.md
Kerberos Ticket Request with Forwardable or Constrained Delegation Options.md
 
 
Kubernetes API Discovery from Workload.md
Kubernetes API Discovery from Workload.md
 
 
Kubernetes Cluster-Admin Role Binding Created or Modified.md
Kubernetes Cluster-Admin Role Binding Created or Modified.md
 
 
Kubernetes Container Escape.md
Kubernetes Container Escape.md
 
 
Kubernetes Container Reverse Shell Execution.md
Kubernetes Container Reverse Shell Execution.md
 
 
Kubernetes Pod Accessing Service Account Tokens.md
Kubernetes Pod Accessing Service Account Tokens.md
 
 
Kubernetes Privileged or Host-Sensitive Workload Creation.md
Kubernetes Privileged or Host-Sensitive Workload Creation.md
 
 
Kubernetes Secret Enumeration by Non-Admin Identity.md
Kubernetes Secret Enumeration by Non-Admin Identity.md
 
 
Kubernetes Security Configuration Tampering.md
Kubernetes Security Configuration Tampering.md
 
 
Kubernetes Suspicious DaemonSet or CronJob Creation.md
Kubernetes Suspicious DaemonSet or CronJob Creation.md
 
 
Kubernetes Suspicious Probing and Subsequent Escalation Activity.md
Kubernetes Suspicious Probing and Subsequent Escalation Activity.md
 
 
Kubernetes Suspicious Service Account Creation and Token Minting.md
Kubernetes Suspicious Service Account Creation and Token Minting.md
 
 
Kubernetes Workload Creation from Unapproved Registry.md
Kubernetes Workload Creation from Unapproved Registry.md
 
 
LDAP Cross-Domain Enumeration.md
LDAP Cross-Domain Enumeration.md
 
 
Microsoft Dynamics 365 Privilege Escalation via Role or Team Modification.md
Microsoft Dynamics 365 Privilege Escalation via Role or Team Modification.md
 
 
NTLM Network Logon to Critical Device.md
NTLM Network Logon to Critical Device.md
 
 
New Privileged Kubernetes Workload Detected.md
New Privileged Kubernetes Workload Detected.md
 
 
New Unusual Process Execution in Container.md
New Unusual Process Execution in Container.md
 
 
Post Phishing UrlClick SuspiciousSignIns.md
Post Phishing UrlClick SuspiciousSignIns.md
 
 
Suspicious Activity Detected in Containerized Environment.md
Suspicious Activity Detected in Containerized Environment.md
 
 
Suspicious Collection of AI Assistant Session Data.md
Suspicious Collection of AI Assistant Session Data.md
 
 
Suspicious Credential Access and Process Memory Enumeration in Kubernetes Containers.md
Suspicious Credential Access and Process Memory Enumeration in Kubernetes Containers.md
 
 
Suspicious DLL Co-loading and Potential Privilege Escalation (RoguePlanet or ShieldCrash).md
Suspicious DLL Co-loading and Potential Privilege Escalation (RoguePlanet or ShieldCrash).md
 
 
Suspicious External Network Connection to Malicious ASN with Rare File Execution.md
Suspicious External Network Connection to Malicious ASN with Rare File Execution.md
 
 
Suspicious Kubernetes Admission Controller Webhook Creation.md
Suspicious Kubernetes Admission Controller Webhook Creation.md
 
 
Suspicious LDAP Reconnaissance from Non-Compliant Devices.md
Suspicious LDAP Reconnaissance from Non-Compliant Devices.md
 
 
Suspicious Modification of Hosts File.md
Suspicious Modification of Hosts File.md
 
 
Suspicious Shell Execution from Container Web Service.md
Suspicious Shell Execution from Container Web Service.md
 
 
Suspicious Shell and Tooling Activity in Containerized Environment.md
Suspicious Shell and Tooling Activity in Containerized Environment.md
 
 
Suspicious Tool Accessing Browser Cookies on macOS.md
Suspicious Tool Accessing Browser Cookies on macOS.md
 
 
Suspicious Windows Policy and Security Registry Tampering.md
Suspicious Windows Policy and Security Registry Tampering.md
 
 
Suspicious oahd Activity on macOS.md
Suspicious oahd Activity on macOS.md
 
 
UEBA High Priority Activity from MCP Client User Agents.md
UEBA High Priority Activity from MCP Client User Agents.md
 
 
Unauthorized Kubelet API or Proxy Access.md
Unauthorized Kubelet API or Proxy Access.md
 
 
Unofficial WinGet Source Added.md
Unofficial WinGet Source Added.md
 
 
Unusual Access to Helm Secrets in Kubernetes.md
Unusual Access to Helm Secrets in Kubernetes.md
 
 
Unusual Kubelet Node Authentication Activity.md
Unusual Kubelet Node Authentication Activity.md
 
 
Unusual LDAP Query Burst from New or Known Device.md
Unusual LDAP Query Burst from New or Known Device.md
 
 
User Risk Event Correlation with Historical Baseline.md
User Risk Event Correlation with Historical Baseline.md
 
 
WinRM Child Process with Inbound Network Logon.md
WinRM Child Process with Inbound Network Logon.md
 
 
Windows Workstations with RDP Enabled and Allowed Connections.md
Windows Workstations with RDP Enabled and Allowed Connections.md
 
 
macOS Keychain Dump via security CLI.md
macOS Keychain Dump via security CLI.md