Valid Accounts: Cloud Accounts `T1078.004`

Tactics: Stealth, Persistence, Privilege Escalation, Initial Access

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Events covered

2 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Security-Auditing	Event ID 4688	A new process has been created.

Authoring guide

Patterns shared across the 290 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (344 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`data_stream.dataset`	85	`eq` 81, `in` 4	`azure.signinlogs`, `aws.cloudtrail`, `okta.system`, `o365.audit`, `azure.activitylogs`
`EventType`	55	`eq` 44, `in` 11, `starts_with` 3	`Sign-in activity`, `UserLoggedIn`, `AssumeRole`, `ConsoleLogin`, `AssumeRoleWithWebIdentity`
`event.outcome`	51	`eq` 45, `in` 6	`success`, `Success`
`OperationName`	39	`eq` 19, `contains` 17, `in` 5	`update a partner cross-tenant access setting`, `Add app role assignment to service principal`, `Add member to role`, `Delete user`, `Update user`
`Provider_Name`	30	`eq` 29, `in` 1	`iam.amazonaws.com`, `sts.amazonaws.com`, `signin.amazonaws.com`, `AzureActiveDirectory`, `ec2.amazonaws.com`
`displayName`	23	`eq` 22, `in` 2, `contains` 1, `is_not_null` 1	`Role.DisplayName`, `AppRole.Value`, `AppAddress`, `DelegatedPermissionGrant.Scope`, `KeyDescription`
`Category`	21	`eq` 21	`RoleManagement`, `ApplicationManagement`, `UserManagement`, `KeyManagement`, `ThreatManagement`
`event.dataset`	20	`eq` 20	`aws.cloudtrail`, `github.audit`, `okta.system`, `google_workspace.device`, `o365.audit`
`type`	19	`eq` 19, `in` 1	`User`, `Policy`, `Role`, `ServicePrincipal`
`aws::eventName`	18	`eq` 15, `in` 3	`ConsoleLogin`, `CreateAccessKey`, `GetCredentialsForIdentity`, `GetFederationToken`, `GetSigninToken`
`event.category`	17	`eq` 17	`authentication`, `configuration`
`sourcetype`	16	`eq` 16	`azure:monitor:aad`, `aws:cloudtrail`, `gws:reports:login`, `OktaIM2:log`, `aws:asl`
`EventID`	13	`eq` 13	`UserLoggedIn`, `5`, `6`, `72`, `ADD_GROUP_MEMBER`
`ResultType`	13	`eq` 12, `ne` 1	`0`, `500121`, `50057`, `53003`, `50074`
`aws::userIdentity.type`	12	`eq` 12	`AssumedRole`, `IAMUser`, `Root`, `FederatedUser`

Top indicator values (928 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN elasticAWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key elasticAWS CloudShell Environment Created elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS EC2 Instance Profile Associated with Running Instance elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM CompromisedKeyQuarantine Policy Attached to User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Login Profile Added to User elasticAWS IAM Long-Term Access Key First Seen from Source IP elasticAWS IAM OIDC Provider Created by Rare User elasticAWS IAM SAML Provider Created elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS Management Console Root Login elasticAWS Rare Source AS Organization Activity elasticAWS Sign-In Console Login with Federated User elasticAWS Sign-In Root Password Recovery Requested elasticAWS Sign-In Token Created elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining elasticAWS Suspicious User Agent Fingerprint elasticAzure Service Principal Sign-In Followed by Arc Cluster Credential Access elasticAzure Storage Account Keys Accessed by Privileged User elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Device Code Grant by Microsoft Authentication Broker elasticEntra ID OAuth Device Code Grant by Unusual User elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth Phishing via First-Party Microsoft Application elasticEntra ID OAuth ROPC Grant Login Detected elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticEntra ID User Reported Suspicious Activity elasticFortiGate FortiCloud SSO Login from Unusual Source elasticM365 Identity Login from Atypical Region elasticM365 Identity Login from Impossible Travel Location elasticOkta User Sessions Started from Different Geolocations elasticSuccessful Application SSO from Rare Unknown Client Device elasticUnusual AWS S3 Object Encryption with SSE-C	45	251
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Access Token Used from Multiple Addresses elasticAWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN elasticAWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key elasticAWS CloudShell Environment Created elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS EC2 Unauthorized Admin Credential Fetch via Assumed Role elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM CompromisedKeyQuarantine Policy Attached to User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Long-Term Access Key First Seen from Source IP elasticAWS IAM OIDC Provider Created by Rare User elasticAWS IAM SAML Provider Created elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS Management Console Root Login elasticAWS Sign-In Console Login with Federated User elasticAWS Sign-In Root Password Recovery Requested elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining elasticAWS Suspicious User Agent Fingerprint elasticUnusual AWS S3 Object Encryption with SSE-C	23	141
`data_stream.dataset`	`eq`	`azure.signinlogs` elasticAzure Service Principal Sign-In Followed by Arc Cluster Credential Access elasticEntra ID Concurrent Sign-in with Suspicious Properties elasticEntra ID High Risk Sign-in elasticEntra ID High Risk User Sign-in Heuristic elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Device Code Flow with Concurrent Sign-ins elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth Phishing via First-Party Microsoft Application elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected elasticEntra ID OAuth ROPC Grant Login Detected elasticEntra ID OAuth User Impersonation to Microsoft Graph elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID PowerShell Sign-in elasticEntra ID Service Principal Federated Credential Authentication by Unusual Client elasticEntra ID Service Principal with Unusual Source ASN elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client elasticEntra ID User Sign-in with Unusual Non-Managed Device	22	30
`data_stream.dataset`	`eq`	`okta.system` elasticFirst Occurrence of Okta User Session Started via Proxy elasticHigh Number of Okta User Password Reset or Unlock Attempts elasticMultiple Okta User Auth Events with Same Device Token Hash Behind a Proxy elasticOkta Sign-In Events via Third-Party IdP elasticOkta Successful Login After Credential Attack elasticOkta User Session Impersonation elasticOkta User Sessions Started from Different Geolocations elasticPotential Okta MFA Bombing via Push Notifications elasticPotentially Successful Okta MFA Bombing via Push Notifications elasticSuccessful Application SSO from Rare Unknown Client Device elasticUnauthorized Access to an Okta Application elasticUnauthorized Scope for Public App OAuth2 Token Grant with Client Credentials	12	48
`data_stream.dataset`	`eq`	`o365.audit` elasticM365 Identity Login from Atypical Region elasticM365 Identity Login from Impossible Travel Location elasticM365 Identity OAuth Flow by First-Party Microsoft App from Multiple IPs elasticM365 Identity OAuth Phishing via First-Party Microsoft Application elasticM365 Identity Unusual SSO Authentication Errors for User elasticM365 Identity User Account Lockouts	6	45
`data_stream.dataset`	`eq`	`azure.identity_protection` elasticEntra ID Protection - Risk Detection - Sign-in Risk elasticEntra ID Protection - Risk Detection - User Risk elasticEntra ID Protection Admin Confirmed Compromise elasticEntra ID Protection Alerts for User Detected elasticEntra ID Protection User Alert and Device Registration	5	5
`type`	`eq`	`User` kustoAccount Created and Deleted in Short Timeframe kustoBulk Changes to Privileged Account Permissions kustoExternal guest invitation followed by Microsoft Entra ID PowerShell signin kustoGuest accounts added in Entra ID Groups other than the ones specified kustoNRT PIM Elevation Request Rejected kustoNRT Privileged Role Assigned Outside PIM kustoPIM Elevation Request Rejected kustoPrivileged Role Assigned Outside PIM kustoSuspicious Login from deleted guest account kustoSuspicious modification of Global Administrator user properties kustoUser Added to Admin Role	11	17
`type`	`eq`	`Policy` kustoCross-tenant Access Settings Organization Added kustoCross-tenant Access Settings Organization Deleted kustoCross-tenant Access Settings Organization Inbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Inbound Direct Settings Changed kustoCross-tenant Access Settings Organization Outbound Collaboration Settings Changed kustoCross-tenant Access Settings Organization Outbound Direct Settings Changed	6	6
`event.category`	`eq`	`authentication` elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID OAuth Device Code Flow with Concurrent Sign-ins elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client elasticEntra ID User Sign-in with Unusual Non-Managed Device elasticFortiGate FortiCloud SSO Login from Unusual Source elasticM365 Identity Unusual SSO Authentication Errors for User elasticM365 Identity User Account Lockouts elasticOkta Admin Console Login Failure	10	31
`event.category`	`eq`	`configuration` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of IP Address For GitHub Personal Access Token (PAT) elasticFirst Occurrence of IP Address For GitHub User elasticFirst Occurrence of Personal Access Token (PAT) Use For a GitHub User elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticFirst Occurrence of User Agent For a GitHub Personal Access Token (PAT) elasticFirst Occurrence of User-Agent For a GitHub User	7	11
`Category`	`eq`	`RoleManagement` sigmaUsers Added to Global or Device Admin Roles kustoAdmin promotion after Role Management Application Permission Grant kustoBulk Changes to Privileged Account Permissions kustoChanges to PIM Settings kustoNRT Privileged Role Assigned Outside PIM kustoPrivileged Account Permissions Changed kustoPrivileged Role Assigned Outside PIM kustoThreat Essentials - User Assigned Privileged Role kustoUser Assigned New Privileged Role	9	17
`Category`	`eq`	`ApplicationManagement` kustoAdmin promotion after Role Management Application Permission Grant kustoApplication ID URI Changed kustoApplication Redirect URL Update kustoChanges to Application Logout URL kustoChanges to Application Ownership kustoMicrosoft Entra ID Role Management Permission Grant kustoURL Added to Application from Unknown Domain	7	12
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Login Profile Added for Root elasticAWS IAM Login Profile Added to User elasticAWS IAM OIDC Provider Created by Rare User elasticAWS IAM SAML Provider Created elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token	9	25
`Provider_Name`	`eq`	`sts.amazonaws.com` elasticAWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN elasticAWS STS AssumeRole with New MFA Device elasticAWS STS AssumeRoot by Rare User and Member Account elasticAWS STS GetSessionToken Usage elasticAWS STS Role Assumption by User elasticAWS STS Role Chaining	6	11
`Provider_Name`	`eq`	`signin.amazonaws.com` elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS Management Console Root Login elasticAWS Sign-In Console Login with Federated User elasticAWS Sign-In Root Password Recovery Requested elasticAWS Sign-In Token Created	5	6
`security_result.action`	`eq`	`ALLOW` chronicleAWS Console Login Without MFA chronicleAWS IAM Administrator Access Policy Attached chronicleAWS User Creates Permanent Access Key chronicleEntra ID Admin Login Activity to Uncommon MS Cloud Apps chronicleEntra ID Login Activity to Uncommon MS Cloud Apps chronicleGCP Workload Identity Pool Disabled Or Deleted chronicleO365 Admin Login Activity To Uncommon Microsoft Cloud Apps chronicleO365 Login Activity To Azure AD PowerShell App chronicleO365 Login Activity To Uncommon Microsoft Cloud Apps	9	102
`Result`	`eq`	`success` kustoAccount created or deleted by non-approved user kustoAccount Elevated to New Role kustoApplication Redirect URL Update kustoConditional Access Policy Modified by New User kustoGuest Users Invited to Tenant by New Inviters kustoSuspicious linking of existing user to external User kustoSuspicious modification of Global Administrator user properties kustoURL Added to Application from Unknown Domain	8	25
`azure_ad::user_type`	`eq`	`Member` elasticEntra ID OAuth Authorization Code Grant for Unusual User, App, and Resource elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected elasticEntra ID OAuth ROPC Grant Login Detected elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID User Sign-in with Unusual Authentication Type elasticEntra ID User Sign-in with Unusual Client elasticEntra ID User Sign-in with Unusual Non-Managed Device	8	10
`event.dataset`	`eq`	`aws.cloudtrail` elasticAWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure elasticAWS EC2 Instance Interaction with IAM Service elasticAWS EC2 Instance Profile Associated with Running Instance elasticAWS IAM Login Profile Added to User elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS Rare Source AS Organization Activity elasticAWS Sign-In Token Created elasticAWS STS GetSessionToken Usage	8	17
`event.dataset`	`eq`	`github.audit` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of IP Address For GitHub Personal Access Token (PAT) elasticFirst Occurrence of IP Address For GitHub User elasticFirst Occurrence of Personal Access Token (PAT) Use For a GitHub User elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticFirst Occurrence of User Agent For a GitHub Personal Access Token (PAT) elasticFirst Occurrence of User-Agent For a GitHub User	7	14
`Status`	`eq`	`Success` sigmaAzure AD Only Single Factor Authentication Required sigmaFailed Authentications From Countries You Do Not Operate Out Of sigmaPassword Reset By User Account sigmaPotential MFA Bypass Using Legacy Client Authentication sigmaPrivileged Account Creation sigmaSuccessful Authentications From Countries You Do Not Operate Out Of sigmaUsers Authenticating To Other Azure AD Tenants	7	10
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaAWS IAM S3Browser LoginProfile Creation sigmaAWS IAM S3Browser Templated S3 Bucket Policy Creation sigmaAWS IAM S3Browser User or AccessKey Creation sigmaAWS SAML Provider Deletion Activity splunkAWS Create Policy Version to allow all resources splunkAWS SetDefaultPolicyVersion pantherAWS Compromised IAM Key Quarantine	7	28
`ResultType`	`eq`	`0` sigmaSign-ins by Unknown Devices kustoAnomalous Single Factor Signin kustoAuthentications of Privileged Accounts Outside of Expected Controls kustoPossible AiTM Phishing Attempt Against Microsoft Entra ID kustoPrivileged User Logon from new ASN kustoSuspicious Login from deleted guest account	6	19
`aws::errorCode`	`eq`	`AccessDenied` sigmaAttempt To Get Credentials For Identity sigmaAttempt To Get Federation Token sigmaAttempt To Get Signin Token sigmaGet Credentials For Identity sigmaGet Federation Token sigmaGet Signin Token	6	19
`event.outcome`	`in`	`Success` elasticAzure Arc Cluster Credential Access by Identity from Unusual Source elasticAzure Kubernetes Services (AKS) Kubernetes Rolebindings Created elasticEntra ID High Risk User Sign-in Heuristic elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID PowerShell Sign-in elasticEntra ID User Added as Service Principal Owner	6	37
`event.outcome`	`in`	`success` elasticAzure Arc Cluster Credential Access by Identity from Unusual Source elasticAzure Kubernetes Services (AKS) Kubernetes Rolebindings Created elasticEntra ID High Risk User Sign-in Heuristic elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID PowerShell Sign-in elasticEntra ID User Added as Service Principal Owner	6	38
`username`	`contains`	`serviceaccount` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6	24
`aws::userIdentity.type`	`eq`	`AssumedRole` elasticAWS EC2 Instance Console Login via Assumed Role elasticAWS EC2 Instance Interaction with IAM Service elasticAWS EC2 Unauthorized Admin Credential Fetch via Assumed Role elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS STS Role Chaining	5	12
`azure_ad::app_id`	`eq`	`29d9ed98-a469-4536-ade2-f981bc1d605e` elasticEntra ID Microsoft Authentication Broker Sign-In to Unusual Resource elasticEntra ID Microsoft Authentication Broker Sign-In with Non-Standard User Agent elasticEntra ID OAuth Device Code Phishing via AiTM elasticEntra ID OAuth Flow by Microsoft Authentication Broker to Device Registration Service (DRS) elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected	5	7
`displayName`	`eq`	`Role.DisplayName` kustoBulk Changes to Privileged Account Permissions kustoPrivileged Account Permissions Changed kustoService Principal Assigned Privileged Role kustoUser Added to Admin Role kustoUser Assigned New Privileged Role	5	6

Exclusions (278 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`responseStatus.code`	`ge`	`1` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`responseStatus.code`	`ge`	`400` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`responseStatus.code`	`le`	`16` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`username`	`in`	`aksService` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`username`	`in`	`masterclient` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`username`	`starts_with`	`system:` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod pantherKubernetes System Role Modified or Deleted	6
`verb`	`ne`	`create` pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Role With Node Proxy Permissions Created pantherKubernetes Role With Pod Exec Permissions Created pantherKubernetes Role With Wildcard Permissions Created pantherKubernetes Service Account Token Theft from Pod	5
`resultSignature`	`ne`	`SUCCESS` pantherAzure Device Code Authentication with Broker Client pantherAzure Microsoft Graph Single Session from Multiple IP Addresses pantherAzure Protection Multiple Alerts for User pantherAzure ROPC Login Attempt Without MFA	4
`aws::errorCode`	`eq`	`AccessDenied` sigmaGet Credentials For Identity sigmaGet Federation Token sigmaGet Signin Token	3
`azure_ad::app_id`	`in`	`ab9b8c07-8f02-4f72-87fa-80105867a763` elasticEntra ID OAuth user_impersonation Scope for Unusual User and Client elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticEntra ID User Sign-in with Unusual Client	3
`operationName`	`ne`	`Sign-in activity` pantherAzure Device Code Authentication with Broker Client pantherAzure Protection Multiple Alerts for User pantherAzure ROPC Login Attempt Without MFA	3
`Location`	`contains`	`<countries you do operate out of e,g gb, use or for multiple>` sigmaFailed Authentications From Countries You Do Not Operate Out Of sigmaSuccessful Authentications From Countries You Do Not Operate Out Of	2
`aws::sessionCredentialFromConsole`	`eq`	`true` elasticAWS Access Token Used from Multiple Addresses elasticAWS IAM API Calls via Temporary Session Tokens	2
`azure.identityprotection.properties.risk_state`	`in`	`confirmedSafe` elasticEntra ID Protection - Risk Detection - Sign-in Risk elasticEntra ID Protection - Risk Detection - User Risk	2
`azure.identityprotection.properties.risk_state`	`in`	`dismissed` elasticEntra ID Protection - Risk Detection - Sign-in Risk elasticEntra ID Protection - Risk Detection - User Risk	2

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Valid Accounts: Cloud Accounts `T1078.004`

Events covered

Authoring guide

Fields filtered most (344 distinct)

Top indicator values (928 distinct)

Exclusions (278 distinct)

Rules under this technique

Sigma 47 rules

Elastic 119 rules

Splunk 20 rules

Kusto 58 rules

YARA-L 15 rules

Panther 31 rules

Keyboard shortcuts

Search operators

Valid Accounts: Cloud Accounts T1078.004

Events covered

Authoring guide

Fields filtered most (344 distinct)

Top indicator values (928 distinct)

Exclusions (278 distinct)

Rules under this technique

Sigma 47 rules

Elastic 119 rules

Splunk 20 rules

Kusto 58 rules

YARA-L 15 rules

Panther 31 rules

Valid Accounts: Cloud Accounts `T1078.004`