Skip to content
Threat Feed
Subscribe

Tag

Suspicious-Activity

4 briefs RSS
medium advisory

Detection of Anomalous Windows Calculator Execution

Detection of potential process masquerading or command-line exploitation attempts leveraging the Windows Calculator binary from non-standard system directories or with abnormal parameters.

suspicious-activity evasion windows
1r 1t
medium advisory

Suspicious PowerShell Execution from Temporary Directories

Detection of potentially malicious PowerShell script execution originating from common temporary directory paths, often indicative of staged payload execution.

execution powershell windows suspicious-activity
1r 1t
medium advisory

Okta End-User Reports Suspicious Account Activity

An Okta end-user reports potentially suspicious activity on their account, indicating possible compromise or unauthorized access.

Okta identity suspicious-activity
2r 1t
medium advisory

Entra ID User Reported Suspicious Activity

This rule detects suspicious activity reported by users in Microsoft Entra ID, indicating potential account compromise or unauthorized access attempts via social engineering during authentication.

Entra ID +1 entra-id suspicious-activity initial-access credential-access
2r 2t