Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
120 detectors match the current filters.
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A browser was opened in private mode A browser was opened in private mode, which may indicate an attempt to cover tracks. | Informational | Identity Threat Detection (ITDR) | XDR Agent | Defense Evasion |
| Analytics BIOC | A Google Workspace identity created, assigned or modified a role A Google Workspace identity created, assigned or modified a delegated admin role. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Persistence |
| Analytics BIOC | A Google Workspace identity performed an unusual admin console activity A Google Workspace identity performed an admin console activity for the first time. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Persistence |
| Analytics BIOC | A Google Workspace identity used the security investigation tool A Google Workspace identity used the security investigation tool The Google Workspace security investigation tool can be abused to access sensitive data. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Collection |
| Analytics BIOC | A Google Workspace Role privilege was deleted A privilege was removed from a Google Workspace Role, This could potentially affect the access to services and data in the organization. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Impact |
| Analytics BIOC | A Google Workspace service was configured as unrestricted An identity configured a Google Workspace service as unrestricted Apps configured with a trusted or limited access setting can access data for unrestricted services. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Privilege Escalation |
| Analytics BIOC | A Google Workspace user was added to a group A user added another user to a Google Workspace group. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Persistence |
| Analytics BIOC | A Google Workspace user was removed from a group A user removed another user from a Google Workspace group. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Impact |
| Analytics BIOC | A Microsoft Teams application was installed A Microsoft Teams application was installed. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Persistence |
| Analytics BIOC | A Microsoft Teams bot was added to a team A user added a bot to a team in Microsoft Teams. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Persistence |
| Analytics BIOC | A third-party application was authorized to access the Google Workspace APIs A domain administrator authorized a third-party application to access the Google Workspace APIs. This allows the application to interact with the domain user's data within the authorized scope, as specified in the API call. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Initial Access, Privilege Escalation |
| Analytics BIOC | A third-party application's access to the Google Workspace domain's resources was revoked An identity removed a third-party application's access to Google Workspace domain's resources. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Impact |
| Analytics | A user accessed an abnormal number of files on a remote shared folder A user remotely accessed an abnormal number of files on a remote shared folder. This might indicate an attempt to collect data before exfiltration. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Discovery |
| Analytics | A user accessed an abnormal number of remote shared folders A user accessed an abnormal number of remote shared folders. This might indicate an attempt to collect data before exfiltration. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics BIOC | A user accessed an uncommon AppID A user accessed an uncommon AppID that is rarely accessed by them or anyone else in the organization. | Informational | Identity Threat Detection (ITDR) | Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall traffic Logs, XDR Agent | Exfiltration |
| Analytics | A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent | Reconnaissance |
| Analytics | A user accessed multiple unusual resources via SSO A user accessed multiple resources via SSO that are unusual for this user. This may be indicative of a compromised account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Discovery, Initial Access |
| Analytics BIOC | A user accessed Okta's admin application An attempt to access Okta's admin management application. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access, Persistence, Privilege Escalation |
| Analytics BIOC | A user added a Windows firewall rule A user added a new Windows Firewall rule. Adding a firewall rule may indicate an attempt to bypass controls limiting network usage or to disrupt network communications. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Defense Evasion |
| Analytics BIOC | A user changed the Windows system time A user changed the Windows system time. This may be indicative of a malicious activity and may affect authentication from the source machine. | Informational | Identity Threat Detection (ITDR) | Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) | Discovery |
| Analytics BIOC | A user connected a new USB storage device to a host A user connected a new USB storage device that was not seen for this user and host in the last 30 days. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection, Exfiltration |
| Analytics BIOC | A user connected a USB storage device for the first time A user connected a USB storage device for the first time in the past 30 days. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection, Exfiltration |
| Analytics BIOC | A user created an abnormal password-protected archive A user created an abnormal password-protected archive using an archive program. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics BIOC | A user modified an Okta MFA factor An Okta MFA factor was modified by a user, suggesting a potential compromise of the account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Credential Access, Persistence |
| Analytics BIOC | A user modified an Okta network zone An Okta network zone was modified by a user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Defense Evasion |
| Analytics BIOC | A user modified an Okta policy rule An Okta policy rule was modified by a user, suggesting a potential compromise of the account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Defense Evasion, Persistence |
| Analytics | A user observed and reported unusual activity in Okta A user observed and reported unusual activity in Okta. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics | A user performed suspiciously massive file activity A user generated massive file activity by size or distinct file count. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics | A user printed an unusual number of files A user printed an unusual number of files. This may be indicative of malicious activity and an attempt to exfiltrate data. | Informational | Identity Threat Detection (ITDR) | Windows Event Collector, XDR Agent with eXtended Threat Hunting (XTH) | Exfiltration |
| Analytics | A user took numerous screenshots A user took numerous screenshots. A valuable organization's information may have been collected in this way. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics BIOC | Admin privileges were granted to a Google Workspace user Admin privileges were granted to a Google Workspace user. This user now has access to additional administrative functions and settings. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Privilege Escalation |
| Analytics BIOC | An app was added to Google Marketplace An app was added to the Google Workspace Marketplace. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Command and Control |
| Analytics BIOC | An app was added to the Google Workspace trusted OAuth apps list An identity added an OAuth app to the Google Workspace trusted OAuth apps list. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Defense Evasion |
| Analytics BIOC | An app was removed from a blocked list in Google Workspace An identity removed an app from Google Workspace blocked OAuth or third-party apps list. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Defense Evasion |
| Analytics BIOC | An unusual archive file creation by a user An archive file was created by a user who doesn't usually create such files. This might indicate an attempt to stage data before exfiltration. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics BIOC | Authentication method added to an Azure account An identity attempted to add an Azure authentication method. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Persistence |
| Analytics BIOC | Azure account creation by a non-standard account An Azure AD account creation was performed by a user that doesn't typically create users. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Persistence |
| Analytics BIOC | Azure AD account unlock/password reset attempt An attempt to unlock an Azure AD identity or reset its password has occurred. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Persistence |
| Analytics BIOC | Azure AD PIM elevation request An Azure AD PIM elevation request was denied/approved. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Privilege Escalation |
| Analytics BIOC | Azure application consent An identity consented permissions to an application. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Initial Access, Credential Access |
| Analytics BIOC | Azure application credentials added An identity added credentials to an Azure application. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Defense Evasion, Persistence |
| Analytics BIOC | Azure application URI modification An identity added or updated an Azure application's URI. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Defense Evasion, Persistence |
| Analytics BIOC | Azure service principal assigned app role An identity assigned an app role (permissions) to a service principal. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Privilege Escalation |
| Analytics BIOC | Azure Temporary Access Pass (TAP) registered to an account An identity registered an Azure Temporary Access Pass (TAP) to an account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Defense Evasion, Privilege Escalation |
| Analytics BIOC | BitLocker key retrieval An identity retrieved a BitLocker Key. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Defense Evasion |
| Analytics BIOC | Chrome Extension Installed By User A Chrome extension was installed or updated by a Google Workspace user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Initial Access, Persistence |
| Analytics BIOC | Chrome OS Remote Access policy was modified in Google Workspace A user modified Chrome OS Remote Access configuration in Google Workspace. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Defense Evasion, Lateral Movement |
| Analytics BIOC | Data Sharing between GCP and Google Workspace was disabled An identity has modified data sharing settings between GCP and Google Workspace. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Defense Evasion, Impact |
| Analytics BIOC | Device Registration Policy modification An identity changed the Device Registration policy. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Defense Evasion |
| Analytics BIOC | DLP sensitive data exposed to external users A user triggered an O365 DLP rule match on data that is viewable by external users. This may indicate an attacker's attempt to access sensitive information. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Collection |
| Analytics BIOC | Exchange compliance search created A user created an Exchange compliance search. This feature enables Administrators to search mailboxes in an organization. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Collection |
| Analytics BIOC | Exchange email-hiding inbox rule A user configured an Exchange inbox rule that may be used to hide emails. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Defense Evasion |
| Analytics BIOC | Exchange email-hiding transport rule A user configured an Exchange transport rule that may be used to hide emails in the organization. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Defense Evasion |
| Analytics BIOC | Exchange inbox forwarding rule configured A user configured an Exchange inbox forwarding rule, which forwards emails that meet specific conditions. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Collection, Exfiltration |
| Analytics | Exchange mailbox delegation permissions added A user added delegation permissions to an Exchange mailbox. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Persistence |
| Analytics BIOC | Exchange mailbox folder permission modification A user modified permissions to an Exchange mailbox folder. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Persistence |
| Analytics | External SaaS file-sharing activity A user shared files from within a SaaS service to an external domain. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit | Collection |
| Analytics BIOC | External Sharing was turned on for Google Drive An identity has modified Google Drive sharing settings and allowed external sharing. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Exfiltration |
| Analytics BIOC | External user added a link to a Microsoft Teams chat An external user added a link to a Microsoft Teams chat. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Initial Access |
| Analytics | External user call via Microsoft Teams An external user called a user in the organization via Microsoft Teams. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Initial Access |
| Analytics | External user created a Microsoft Teams conversation with suspicious operations An external user created a Microsoft Teams conversation with users in the organization with additional suspicious operations. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Initial Access |
| Analytics | External user started a Microsoft Teams conversation An external user started a Microsoft Teams conversation with users in the organization. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Initial Access |
| Analytics BIOC | First-time directory sync of an on-premises domain user to an existing cloud account First-time synchronization of an on-premises domain user with an existing cloud account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Persistence |
| Analytics BIOC | Gmail delegation was turned on for the organization A Google Workspace admin turned on Gmail delegation for all the organization's users. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Privilege Escalation |
| Analytics BIOC | Gmail routing settings changed Gmail routing settings were modified. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Collection |
| Analytics BIOC | Google Marketplace restrictions were modified An identity modified Google Marketplace Restrictions. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Privilege Escalation |
| Analytics BIOC | Google Workspace automation was created Google Workspace automation was created. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Execution, Persistence, Exfiltration |
| Analytics BIOC | Google Workspace organizational unit was modified A Google Workspace admin modified an organizational unit. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Persistence |
| Analytics BIOC | Google Workspace third-party application's security settings were changed An identity changed Google Workspace third-party application's security settings. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Privilege Escalation |
| Analytics BIOC | Google Workspace user authentication information changed Google Workspace authentication information was changed for a user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Credential Access, Persistence |
| Analytics BIOC | Identity assigned an Azure AD Administrator Role An identity was assigned an Azure AD Administrator role. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Persistence |
| Analytics | Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent | Reconnaissance |
| Analytics BIOC | Invalid SAML Detected A user attempted to sign in using an invalid SAML. This might indicate a Golden SAML attack. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD, Okta | Credential Access |
| Analytics | Large volume of files potentially containing credentials accessed in Google Drive A user accessed a large volume of files potentially containing credentials in Google Drive. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Collection, Credential Access |
| Analytics | Massive file activity abnormal to process A user generated massive file activity by size or distinct file count. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics | Massive file compression by user Multiple archive files were created by a user. This might indicate an attempt to stage data before exfiltration. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection |
| Analytics | Massive file downloads from SaaS service A user downloaded a large volume of files from an organizational SaaS service, either exceeding the normal file count or size for the user's typical behavior. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit | Collection |
| Analytics | Massive files deletion in Box A user deleted a large amount of data in Box. This behavior may indicate that the data is being wiped. | Informational | Identity Threat Detection (ITDR) | Box Audit Log | Impact |
| Analytics | Massive files deletion in Dropbox A user deleted a large amount of data in Dropbox. This behavior may indicate that the data is being wiped. | Informational | Identity Threat Detection (ITDR) | DropBox | Impact |
| Analytics | Massive files deletion in Google Drive A user deleted a large amount of data in Google Drive. This behavior may indicate that the data is being wiped. | Informational | Identity Threat Detection (ITDR) | Google Workspace Audit Logs | Impact |
| Analytics | Massive files deletion in Microsoft SharePoint or OneDrive A user deleted a large amount of data in Microsoft SharePoint or OneDrive. This behavior may indicate that the data is being wiped. | Informational | Identity Threat Detection (ITDR) | Office 365 Audit | Impact |
| Analytics | Massive upload to a rare storage or mail domain A large amount of data was transferred to an external site that is used for mail or storage. This behavior may indicate data exfiltration. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, XDR Agent | Exfiltration |
| Analytics | Massive upload to SaaS service A user uploaded a large amount of data to an organizational cloud storage. This behavior may indicate that the data is being exfiltrated or staged. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Box Audit Log, DropBox, Google Workspace Audit Logs, Office 365 Audit | Exfiltration, Collection |
| Analytics BIOC | MFA was disabled for a Google Workspace user Multi-Factor Authentication (MFA) has been disabled for a Google Workspace user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Google Workspace Audit Logs | Defense Evasion |
| Analytics BIOC | Microsoft 365 DLP policy disabled or removed A user disabled or removed a Microsoft 365 data loss prevention (DLP) policy, which may indicate DLP monitoring evasion. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security | Office 365 Audit | Defense Evasion |
| Analytics BIOC | Microsoft Teams application setup policy was modified Microsoft Teams the application setup policy, which is responsible for application management, was modified. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Defense Evasion, Persistence |
| Analytics BIOC | Microsoft Teams external communication policy was modified Microsoft Teams external communication policy was modified. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Defense Evasion, Exfiltration |
| Analytics BIOC | Microsoft Teams messages were exported from conversation Microsoft Teams messages were exported from conversation. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Collection |
| Analytics BIOC | New Teams application published to the organization catalog A new Teams application was published to the organization catalog. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Office 365 Audit | Persistence |
| Analytics | Okta account reset password attempt A user used a weak factor to reset their Okta password. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics | Okta account unlock Okta user account was unlocked. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics BIOC | Okta account unlock by admin An administrative user unlocked an Okta account. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics BIOC | Okta admin privilege assignment A user assigned admin privileges to a new user or group. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Privilege Escalation |
| Analytics BIOC | Okta API Token Created A user created a new API token in Okta. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Privilege Escalation, Execution, Persistence |
| Analytics | Okta device assignment A device was assigned as an Okta MFA device to a user. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access, Persistence |
| Analytics | Okta Reported Threat Detected Okta Threat Insight Reported Threat Detected. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics BIOC | Okta User Session Impersonation A user has initiated a session impersonation in Okta. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Okta Audit Log | Initial Access |
| Analytics BIOC | Owner added to Azure application An identity was added as an owner to an Azure application. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD Audit Log | Credential Access |
| Analytics | Possible ConsentFix - OAuth Token Theft Detected Detection of potential OAuth token theft via a forced 'localhost' redirect and first-party app abuse. This indicates an attacker has likely bypassed MFA to hijack a user's cloud session. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | AzureAD | Initial Access, Credential Access, Execution |
| Analytics | Possible data exfiltration over a USB storage device A process generated massive file creation, renaming and write activity to a USB storage device. | Informational | Identity Threat Detection (ITDR) | XDR Agent with eXtended Threat Hunting (XTH) | Collection, Exfiltration |