GCP Vertex AI Role Granted to Principal

MediumMicrosoft Sentinel analytics

RedRays - Profile Parameters

Identifies new or materially changed, actionable profile parameter checks from RedRays. Checks marked VULNERABLE raise Medium severity alerts under the integration's policy. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse weakened SAP security settings, not evidence of an attack. Records outside the one-day query window do not trigger this rule.

T1110T1562

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

RedRays - Vulnerability Assessment

Identifies new or materially changed, actionable SAP vulnerabilities from RedRays. Only High or Critical findings are selected. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse exploitable SAP vulnerabilities, not evidence of an attack. Records outside the one-day query window do not trigger this rule.

T1068T1190

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

RedRays - SoD

Identifies new or materially changed, actionable segregation of duties findings from RedRays. Only High or Critical findings are selected. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse excessive SAP authorizations, not evidence of an attack. Records outside the one-day query window do not trigger this rule.

T1078

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

RedRays - Password Security

Identifies new or materially changed, actionable password security findings from RedRays. Only High or Critical findings are selected. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes password recovery during an authorized assessment, not evidence of an adversary attack. Records outside the one-day query window do not trigger this rule.

T1110

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

RedRays - Cloud Security

Identifies new or materially changed, actionable BTP security findings from RedRays. Only High or Critical findings are selected. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse misconfigured BTP accounts and access, not evidence of an attack. Records outside the one-day query window do not trigger this rule.

T1078

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

RedRays - ABAP Code Security

Identifies new or materially changed, actionable ABAP code findings from RedRays. Only High or Critical findings are selected. Initial findings raise alerts only if you enable baseline alerting in RedRays. The ATT&CK mapping describes how an adversary could abuse exploitable custom ABAP code, not evidence of an attack. Records outside the one-day query window do not trigger this rule.

T1068T1190

Licence: MIT License
Published: Oct 28, 2026

MediumMicrosoft Sentinel analytics

NRT First access credential added to Application or Service Principal where no credential was present

This will alert when an admin or app owner account adds a new credential to an Application or Service Principal where there was no previous verify KeyCredential associated. If a threat actor obtains access to an account with sufficient privileges and adds the alternate authentication material triggering this event, the threat actor can now authenticate as the Application or Service Principal using this credential.

T1550.001

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Suspicious Service Principal creation activity

This alert will detect creation of an SPN, permissions granted, credentials created, activity and deletion of the SPN in a time frame (default 10 minutes)

T1078T1528

Licence: MIT License
Published: Oct 28, 2026

MediumMicrosoft Sentinel analytics

Possible SignIn from Azure Backdoor

Identifies when a user adds an unverified domain as an authentication method, followed by a sign-in from a user the newly added domain. Threat actors may add custom domains to create a backdoor to your tenant. It's important to monitor whenever custom domains are added to the tenant.

T1098

Licence: MIT License
Published: Oct 28, 2026

MediumMicrosoft Sentinel analytics

NRT Authentication Methods Changed for VIP Users

Identifies authentication methods being changed for a list of VIP users watchlist. This could be an indication of an attacker adding an auth method to the account so they can have continued access.

T1098

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

Conditional Access - Dynamic Group Exclusion Changes

// Detects changes to Dynamic Membership Rules for specified groups (often used in CA exclusions)

T1484

Licence: MIT License
Published: Oct 28, 2026

InformationalMicrosoft Sentinel analytics

Conditional Access - A new Conditional Access policy was created

A new Conditional Access policy was created in Entra ID.

T1562.007

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

Conditional Access - A Conditional Access user/group/role exclusion has changed

A Conditional Access user/group/role exclusion has changed in Azure AD.

T1078T1098

Licence: MIT License
Published: Oct 28, 2026

InformationalMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was updated

A Conditional Access policy was updated in Entra ID.

T1562

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was put into report-only mode

A Conditional Access policy was put into report-only mode in Entra ID.

T1562.007

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was disabled

A Conditional Access policy was disabled in Entra ID.

T1562.007

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access policy was deleted

A Conditional Access policy was deleted from Entra ID.

T1562.007

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access app exclusion has changed

A Conditional Access app exclusion has changed in Entra ID.

T1071

Licence: MIT License
Published: Oct 28, 2026

LowMicrosoft Sentinel analytics

Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)

A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed) in Entra ID.

T1562.007

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

Azure RBAC (Elevate Access)

Detects when a Global Administrator elevates access to all subscriptions and management groups in a tenant. When a Global Administrator elevates access they are assigned the User Access Administrator role at root scope. This Microsoft Sentinel Analytic Rule monitors who has elevated access in your tenant so that admins can take appropriate action. [Learn more](https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin?tabs=azure-portal)

T1078

Licence: MIT License
Published: Oct 28, 2026

HighMicrosoft Sentinel analytics

Jira - Site admin user password changed

Identifies password changes for users added to the site-admins group during the previous 14 days.

T1078

Licence: MIT License
Published: Oct 28, 2026

HighElastic detection rules

Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score

A supervised machine learning model (ProblemChild) has identified a suspicious Windows process event with high probability of it being malicious activity.

T1036T1036.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

MediumElastic detection rules

OpenAI ChatGPT Enterprise Jailbreak Prompt Heuristics

Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or developer mode), asking it to operate without safety restrictions or filters, or asking it to reveal its system prompt.

T1562

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

LowElastic detection rules

First Time GCP Vertex AI Inference by Caller from Source ASN

Detects the first time in 14 days that a Vertex AI caller (user or service account) runs model inference (GenerateContent, StreamGenerateContent, Predict, or RawPredict) from a source autonomous system (ASN). Stolen Google Cloud credentials, including exported service account keys and OAuth tokens, are used for LLMjacking from attacker infrastructure, which shows up as the victim identity calling models from a hosting provider, VPN, or residential proxy network it has never used before.

T1078T1078.004

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

MediumElastic detection rules

GCP Vertex AI Role Granted to Principal

Identifies an IAM policy change on a Google Cloud project, folder, or organization that grants a Vertex AI role (`roles/aiplatform.*`) to a principal. Vertex AI roles control who can invoke models, deploy endpoints, run agents, and read prompt and training data. An adversary who has gained IAM administration rights can grant a Vertex AI role to an identity they control to keep model access after the original foothold is removed, or to run LLMjacking workloads under the victim's billing.

T1098T1098.003

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

MediumElastic detection rules

Microsoft Foundry Content Filter Modified or Deleted

Identifies the creation, modification, or deletion of a content filter (RAI policy) or a custom blocklist on a Microsoft Foundry (Azure AI Services) account. Content filters decide which prompt and completion categories, jailbreak attempts, and protected material a model deployment blocks. An adversary with control of the account can weaken or remove these filters so that harmful prompts and outputs are no longer blocked or logged as filtered, which removes a guardrail and the detections that

T1562T1562.001

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

MediumElastic detection rules

Microsoft Foundry Keys or Connection Secrets Accessed by New Principal

Identifies the first time in seven days that a high-privilege Azure principal lists or regenerates the API keys of a Microsoft Foundry (Azure AI Services) account, or reads the stored secrets of a Foundry account or project connection. Account keys grant direct inference access to every model deployment on the account and bypass Entra ID conditional access, and connection secrets hold credentials for downstream services such as Azure OpenAI, storage, and search.

T1078T1078.004T1555T1555.006

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

MediumElastic detection rules

AWS Bedrock Model Invocation Impossible Travel

Detects the same AWS principal invoking Amazon Bedrock models (InvokeModel, Converse, and their streaming variants) from geographically distant source IPs within a short window at an impossible travel speed. Stolen access keys and session credentials are frequently resold or reused for LLMjacking, and an inference call from a second continent minutes after a legitimate one is a strong indicator that the credential is being used by someone else.

T1078T1078.004T1528

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

CriticalElastic detection rules

AWS Bedrock Model Invocation From High Number of Countries

Detects a single AWS principal invoking Amazon Bedrock models from three or more countries and three or more source IPs within the lookback window. LLMjacking operators often distribute stolen AWS credentials across proxies or resell them to multiple buyers, which produces inference traffic for one identity from many unrelated locations.

T1078T1078.004T1528

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

HighElastic detection rules

Potential Destructive AWS CLI Command Executed by GenAI Agent

Identifies a cloud CLI command that destroys infrastructure or identities, such as terminating EC2 instances, removing S3 buckets, or deleting IAM users, when it is spawned by a GenAI coding agent directly or through the agent's shell wrapper. A compromised or prompt-injected agent can be steered into wiping the developer's environment and cloud account using the credentials it already holds, as seen in the malicious Amazon Q Developer for VS Code v1.84.0 release (AWS-2025-015).

T1485T1531T1562T1562.008

Written by: ElasticAttributed by Elastic detection rules
Licence: Elastic License 2.0
Published: Oct 28, 2026

Reference	Class	Cited by
cloud.google.com/iam/docs/audit-logging	Product documentation	Only this detection cites it
cloud.google.com/vertex-ai/docs/general/access-control	Product documentation	Only this detection cites it
www.elastic.co/docs/reference/integrations/gcp/audit	Product documentation	Only this detection cites it

Detection rules

GCP Vertex AI Role Granted to Principal

Description

Detection logic

Detection requirements

Known benign triggers

MITRE ATT&CK mappings

References

From the source

Licence

Authorship

Detection rules