Techniques
Sample rules
Unusual GCP Event for a User
- source: elastic
- technicques:
- T1021
- T1041
- T1078
Description
A machine learning job detected an GCP Audit event that, while not inherently suspicious or abnormal, is being made by a user context that does not normally use the event action. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.
Detection logic
Unusual Azure Activity Logs Event for a User
- source: elastic
- technicques:
- T1021
- T1041
- T1078
Description
A machine learning job detected Azure Activity Logs activity that, while not inherently suspicious or abnormal, is sourcing from user context that does not normally use the event action. This can be the result of compromised credentials or keys as someone uses a valid account to persist, move laterally, or exfiltrate data.
Detection logic