Every published rule

Kubernetes Service Account Created via Audit Log

Alerts on Kubernetes audit events showing new ServiceAccounts created.

Kubernetes Audit: Listing Secrets (Enumeration of Secret Resources)

Alerts on Kubernetes audit requests that list the secrets resource, consistent with secret enumeration.

Kubernetes RBAC SelfSubjectRulesReview Permission Enumeration Attempt

Alerts on Kubernetes selfsubjectrulesreviews API calls that enumerate the caller’s RBAC permissions.

Kubernetes Privileged Pod Created via Pod Creation Requests

Flags Kubernetes pod creates where container capabilities are set to all, indicating possible privileged access setup.

Kubernetes Pod Created With hostPath Volume Mount

Alerts on Kubernetes pod creation requests that include a hostPath volume mount.

Kubernetes Deployment Deleted via Kubernetes API Audit Logs

Alerts when Kubernetes audit logs show a delete action against deployments.

Windows Registry: MaxMpxCt Value Changed (LanmanServer Parameters)

Monitors Windows registry updates to MaxMpxCt under LanmanServer parameters, impacting SMB connection request handling.

Windows TeamViewer Remote Session Process Command Line Start

Flags TeamViewer_Desktop.exe being launched by TeamViewer_Service.exe with the expected IPCport and module parameters on Windows.

macOS TeamViewer Remote Session Launch via TeamViewer_Service Command Line

Flags macOS executions of TeamViewer Desktop with the IPC/module command line when launched by the TeamViewer service.

TeamViewer Remote Session Startup Command Execution on Linux

Flags Linux process launches of TeamViewer_Desktop with IPC port/module arguments under TeamViewer_Service, indicating remote session startup.

Windows Kerberos KDC Key Distribution Failure: No Suitable Encryption Key or Unsupported EType

Flags KDC TGS generation failures where no suitable encryption key intersects or the requested encryption type is unsupported.

Windows AD CS Denied Certificate Enrollment Requests (Event ID 53)

Alerts on CA-side denied certificate enrollment attempts in Windows via Microsoft-Windows-CertificationAuthority Event ID 53.

GitHub Audit: Secret Scanning Push Protection Bypass Event Detected

Triggers on GitHub audit events indicating a secret scanning push protection bypass attempt.

Windows Shell Context Menu Registry Command Tampering

Flags Windows registry modifications that add or alter shell context menu commands under Classes\shell\command.

Windows DNS Queries to update.onelaunch.com by OneLaunch.exe

Flags DNS requests to update.onelaunch.com from OneLaunch.exe on Windows.

Bitbucket Audit: Secret Scanning Rule Deleted for Project or Repository

Flags Bitbucket audit events indicating secret scanning rules were deleted at the project or repository level.

Bitbucket audit: Project secret scanning allowlist rule added

Alerts when Bitbucket records a project secret scanning allowlist rule being added via the audit log.

Windows sc.exe Service Query for termservice Enumeration

Alerts on sc.exe service querying that references termservice on Windows.

Windows: Detect MODE.COM Changing Code Page Settings

Detects MODE.COM executions that include code page selection parameters.

macOS SIP Status Enumeration via csrutil status

Flags execution of "csrutil status" on macOS to enumerate System Integrity Protection state.