Change

Abnormally High Number Of Cloud Security Group API Calls

Cloud Accounts, Valid Accounts

Cloud Instance Modified By Previously Unseen User

Cloud Accounts, Valid Accounts

Abnormally High Number Of Cloud Infrastructure API Calls

Cloud Accounts, Valid Accounts

Detect USB device insertion

Windows AD Domain Replication ACL Addition

Domain or Tenant Policy Modification

Cloud Compute Instance Created With Previously Unseen Image

Abnormally High Number Of Cloud Instances Destroyed

Cloud Accounts, Valid Accounts

Okta New Device Enrolled on Account

Account Manipulation, Device Registration

Kerberos Pre-Authentication Flag Disabled in UserAccountControl

Steal or Forge Kerberos Tickets, AS-REP Roasting

Cloud Provisioning Activity From Previously Unseen Country

Valid Accounts

PingID New MFA Method After Credential Reset

Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration

Detect Excessive User Account Lockouts

Valid Accounts, Local Accounts

Windows AD Replication Request Initiated from Unsanctioned Location

DCSync, OS Credential Dumping

Detect Excessive Account Lockouts From Endpoint

Valid Accounts, Domain Accounts

Windows Create Local Account

Local Account, Create Account

Windows Disable Change Password Through Registry

Modify Registry

Cloud Security Groups Modifications by User

Modify Cloud Compute Configurations

Windows AD Rogue Domain Controller Network Activity

Rogue Domain Controller

Cloud Compute Instance Created By Previously Unseen User

Cloud Accounts, Valid Accounts

Cloud Provisioning Activity From Previously Unseen Region

Valid Accounts

O365 Advanced Audit Disabled

Impair Defenses, Disable or Modify Cloud Logs

Cloud Provisioning Activity From Previously Unseen IP Address

Valid Accounts

Abnormally High Number Of Cloud Instances Launched

Cloud Accounts, Valid Accounts

Cloud Provisioning Activity From Previously Unseen City

Valid Accounts

Windows AD Replication Request Initiated by User Account

DCSync, OS Credential Dumping

O365 Elevated Mailbox Permission Assigned

Account Manipulation, Additional Email Delegate Permissions

Cloud API Calls From Previously Unseen User Roles

Valid Accounts

Cloud Compute Instance Created With Previously Unseen Instance Type

Short Lived Windows Accounts

Local Account, Create Account

Okta Multi-Factor Authentication Disabled

Modify Authentication Process, Multi-Factor Authentication

Windows AD Domain Controller Audit Policy Disabled

Disable or Modify Tools

Windows AD DSRM Password Reset

Account Manipulation

Okta New API Token Created

Valid Accounts, Default Accounts

Okta Multiple Accounts Locked Out

Brute Force

Cloud Compute Instance Created In Previously Unused Region

Unused/Unsupported Cloud Regions

O365 SharePoint Allowed Domains Policy Changed

Cloud Account

Windows AD Suspicious Attribute Modification

Use Alternate Authentication Material, File and Directory Permissions Modification, Windows File and Directory Permissions Modification