Authentication

Azure AD New MFA Method Registered

Account Manipulation, Device Registration

Azure AD Multiple AppIDs and UserAgents Authentication Spike

Valid Accounts

Azure AD Privileged Authentication Administrator Role Assigned

Security Account Manager

Windows AD Replication Request Initiated from Unsanctioned Location

DCSync, OS Credential Dumping

Okta MFA Exhaustion Hunt

Brute Force

Windows AD Replication Request Initiated by User Account

DCSync, OS Credential Dumping

Detect AWS Console Login by User from New Region

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New Country

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Detect AWS Console Login by User from New City

Compromise Accounts, Cloud Accounts, Unused/Unsupported Cloud Regions

Azure AD Multi-Factor Authentication Disabled

Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication

AWS Credential Access Failed Login

Compromise Accounts, Cloud Accounts, Brute Force, Password Guessing

Azure AD Successful Single-Factor Authentication

Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts

Potential password in username

Local Accounts, Credentials In Files

Detect AWS Console Login by New User

Compromise Accounts, Cloud Accounts, Unsecured Credentials

Windows Kerberos Local Successful Logon

Steal or Forge Kerberos Tickets

O365 Excessive Authentication Failures Alert

Brute Force

O365 Bypass MFA via Trusted IP

Disable or Modify Cloud Firewall, Impair Defenses

O365 Disable MFA

Modify Authentication Process

AWS Cross Account Activity From Previously Unseen Account

Detect New Login Attempts to Routers