Analytics rules — August 09, 2026
1293 files changed, 53061 insertions, 0 deletions — view the commit on the mirror.
Analytics rule catalog exported for the first time: 1,293 detectors
This is the analytics mirror’s first export, not a day of change to an existing catalog. All 1,293 files under analytics/ are additions — nothing was modified or removed, so there is no prior baseline to diff against.
Each file is one exported detection rule. Given the size and all-additions shape of this commit, individual rules were not read; see the mirror for the full list.
Bulk change — 1,293 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
1293 files listed.
-
▸ ▾ The CA policy EditFlags was queried added +22 −0
analytics/the-ca-policy-editflags-was-queriedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ The Linux system firewall was disabled added +22 −0
analytics/the-linux-system-firewall-was-disabledRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Training simulation email detected added +22 −0
analytics/training-simulation-email-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon access to cloud platforms' sensitive files by a scripting engine added +36 −0
analytics/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon access to /etc/passwd added +251 −0
analytics/uncommon-access-to-etc-passwdRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon access to Microsoft Teams cookies files added +38 −0
analytics/uncommon-access-to-microsoft-teams-cookies-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon access to Microsoft Teams credential files added +36 −0
analytics/uncommon-access-to-microsoft-teams-credential-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon AppleScript containing a potential persistence command was executed via the command line added +57 −0
analytics/uncommon-applescript-containing-a-potential-persistence-command-was-executed-via-the-command-lineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon ARP cache listing via arp.exe added +22 −0
analytics/uncommon-arp-cache-listing-via-arp-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon AT task-job creation by user added +49 −0
analytics/uncommon-at-task-job-creation-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon attempt at discovering a sensitive file added +181 −0
analytics/uncommon-attempt-at-discovering-a-sensitive-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon attempt at grabbing credentials from a sensitive file added +173 −0
analytics/uncommon-attempt-at-grabbing-credentials-from-a-sensitive-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon attempt to clear shell history added +36 −0
analytics/uncommon-attempt-to-clear-shell-historyRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Azure Cosmos DB master key read by identity added +22 −0
analytics/uncommon-azure-cosmos-db-master-key-read-by-identityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon browser extension loaded added +22 −0
analytics/uncommon-browser-extension-loadedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon cloud CLI tool usage added +75 −0
analytics/uncommon-cloud-cli-tool-usageRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon communication to an instant messaging server added +49 −0
analytics/uncommon-communication-to-an-instant-messaging-serverRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon creation or access operation of sensitive shadow copy added +49 −0
analytics/uncommon-creation-or-access-operation-of-sensitive-shadow-copyRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon DLL-sideloading from a logical CD-ROM (ISO) device added +25 −0
analytics/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-deviceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon DotNet module load relationship added +22 −0
analytics/uncommon-dotnet-module-load-relationshipRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon driver loaded added +62 −0
analytics/uncommon-driver-loadedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon execution of ODBCConf added +36 −0
analytics/uncommon-execution-of-odbcconfRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon file access over WebDAV added +36 −0
analytics/uncommon-file-access-over-webdavRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon GetClipboardData API function invocation of a possible information stealer added +22 −0
analytics/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon increase in Azure Microsoft Graph API request sizes added +63 −0
analytics/uncommon-increase-in-azure-microsoft-graph-api-request-sizesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon IP Configuration Listing via ipconfig.exe added +22 −0
analytics/uncommon-ip-configuration-listing-via-ipconfig-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon jsp file write by a Java process added +22 −0
analytics/uncommon-jsp-file-write-by-a-java-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon kernel module load added +36 −0
analytics/uncommon-kernel-module-loadRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Launch Agent persistency was registered or modified added +164 −0
analytics/uncommon-launch-agent-persistency-was-registered-or-modifiedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Launch Daemon persistency was registered or modified added +164 −0
analytics/uncommon-launch-daemon-persistency-was-registered-or-modifiedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Linux process communication to a rare external host added +104 −0
analytics/uncommon-linux-process-communication-to-a-rare-external-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Linux remote shell command execution added +295 −0
analytics/uncommon-linux-remote-shell-command-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Linux shell command execution added +262 −0
analytics/uncommon-linux-shell-command-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon local scheduled task creation via schtasks.exe added +75 −0
analytics/uncommon-local-scheduled-task-creation-via-schtasks-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon login item persistency was registered or modified added +86 −0
analytics/uncommon-login-item-persistency-was-registered-or-modifiedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon macOS process communication to a rare external host added +215 −0
analytics/uncommon-macos-process-communication-to-a-rare-external-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon macOS shell command execution added +188 −0
analytics/uncommon-macos-shell-command-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Managed Object Format (MOF) compiler usage added +22 −0
analytics/uncommon-managed-object-format-mof-compiler-usageRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon msiexec execution of an arbitrary file from a remote location added +36 −0
analytics/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-locationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon net group command execution added +130 −0
analytics/uncommon-net-group-command-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon net localgroup command execution added +130 −0
analytics/uncommon-net-localgroup-command-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon net localgroup execution added +36 −0
analytics/uncommon-net-localgroup-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon network tunnel creation added +62 −0
analytics/uncommon-network-tunnel-creationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon NtWriteVirtualMemoryRemote API invocation with a PE header buffer added +80 −0
analytics/uncommon-ntwritevirtualmemoryremote-api-invocation-with-a-pe-header-bufferRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon PowerShell commands used to create or alter scheduled task parameters added +22 −0
analytics/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parametersRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon RDP connection added +22 −0
analytics/uncommon-rdp-connectionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon recurring rare external host access added +128 −0
analytics/uncommon-recurring-rare-external-host-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon remote monitoring and management tool added +75 −0
analytics/uncommon-remote-monitoring-and-management-toolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon remote scheduled task creation added +36 −0
analytics/uncommon-remote-scheduled-task-creationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon remote service start via sc.exe added +22 −0
analytics/uncommon-remote-service-start-via-sc-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon reverse SSH tunnel to external domain/ip added +36 −0
analytics/uncommon-reverse-ssh-tunnel-to-external-domain-ipRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon routing table listing via route.exe added +22 −0
analytics/uncommon-routing-table-listing-via-route-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Security Support Provider (SSP) registered via a registry key added +22 −0
analytics/uncommon-security-support-provider-ssp-registered-via-a-registry-keyRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon sensitive filesystem registry hive access added +80 −0
analytics/uncommon-sensitive-filesystem-registry-hive-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon sensitive registry hive dump added +75 −0
analytics/uncommon-sensitive-registry-hive-dumpRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon Service Create/Config added +22 −0
analytics/uncommon-service-create-configRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon service stop operation added +22 −0
analytics/uncommon-service-stop-operationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon SetWindowsHookEx API invocation of a possible keylogger added +23 −0
analytics/uncommon-setwindowshookex-api-invocation-of-a-possible-keyloggerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon signed process execution by scheduled task added +62 −0
analytics/uncommon-signed-process-execution-by-scheduled-taskRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon SQL like command line added +62 −0
analytics/uncommon-sql-like-command-lineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon SSH session was established added +222 −0
analytics/uncommon-ssh-session-was-establishedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon URL domain(s) in your organization detected in email added +70 −0
analytics/uncommon-url-domain-s-in-your-organization-detected-in-emailRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon user management via net.exe added +24 −0
analytics/uncommon-user-management-via-net-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon VNC server communication added +85 −0
analytics/uncommon-vnc-server-communicationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Uncommon WPAD queries added +63 −0
analytics/uncommon-wpad-queriesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unicode RTL Override Character added +22 −0
analytics/unicode-rtl-override-characterRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unique client computer model was detected via MS-Update protocol added +22 −0
analytics/unique-client-computer-model-was-detected-via-ms-update-protocolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unknown DLL was added to the AD FS Global Assembly Cache path added +38 −0
analytics/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-pathRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unpopular domains detected in email URLs for a recipient added +40 −0
analytics/unpopular-domains-detected-in-email-urls-for-a-recipientRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unpopular rsync process execution added +36 −0
analytics/unpopular-rsync-process-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unprivileged process opened a registry hive added +22 −0
analytics/unprivileged-process-opened-a-registry-hiveRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unrecognized internal address (AAD mismatch) added +22 −0
analytics/unrecognized-internal-address-aad-mismatchRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned and unpopular process performed a DLL injection added +88 −0
analytics/unsigned-and-unpopular-process-performed-a-dll-injectionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned and unpopular process performed an injection added +115 −0
analytics/unsigned-and-unpopular-process-performed-an-injectionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned DLL Hijack into a Microsoft process added +130 −0
analytics/unsigned-dll-hijack-into-a-microsoft-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned DLL Side-Loading added +115 −0
analytics/unsigned-dll-side-loadingRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned process creates a scheduled task via file access added +38 −0
analytics/unsigned-process-creates-a-scheduled-task-via-file-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unsigned process injecting into a Windows system binary with no command line added +23 −0
analytics/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-lineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Untrusted process contacted LLM API added +36 −0
analytics/untrusted-process-contacted-llm-apiRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual access to Microsoft 365 storage services added +37 −0
analytics/unusual-access-to-microsoft-365-storage-servicesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual access to the AD Sync credential files added +49 −0
analytics/unusual-access-to-the-ad-sync-credential-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual access to the Windows Internal Database on an ADFS server added +36 −0
analytics/unusual-access-to-the-windows-internal-database-on-an-adfs-serverRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual ADConnect database file access added +49 −0
analytics/unusual-adconnect-database-file-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual ADFS Remote Synchronization network connections from non-ADFS server added +25 −0
analytics/unusual-adfs-remote-synchronization-network-connections-from-non-adfs-serverRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AI dataset modification added +38 −0
analytics/unusual-ai-dataset-modificationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AI Knowledge Base Modification added +37 −0
analytics/unusual-ai-knowledge-base-modificationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AI model invocation added +23 −0
analytics/unusual-ai-model-invocationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AI RAG Knowledge Base Modification added +23 −0
analytics/unusual-ai-rag-knowledge-base-modificationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual attachment volume in outbound emails added +49 −0
analytics/unusual-attachment-volume-in-outbound-emailsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS Bedrock model access request added +22 −0
analytics/unusual-aws-bedrock-model-access-requestRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS CLI/SDK activity added +22 −0
analytics/unusual-aws-cli-sdk-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS credentials creation added +22 −0
analytics/unusual-aws-credentials-creationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS S3 objects deletion added +52 −0
analytics/unusual-aws-s3-objects-deletionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS SageMaker notebook access added +22 −0
analytics/unusual-aws-sagemaker-notebook-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS systems manager activity added +24 −0
analytics/unusual-aws-systems-manager-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual AWS user added to group added +36 −0
analytics/unusual-aws-user-added-to-groupRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Azure AD sync module load added +36 −0
analytics/unusual-azure-ad-sync-module-loadRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual certificate management activity added +24 −0
analytics/unusual-certificate-management-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual CertLog Remote File Write added +36 −0
analytics/unusual-certlog-remote-file-writeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual CIM repository file access added +38 −0
analytics/unusual-cim-repository-file-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.