Threat Findings
Threat Findings
Time Rangelast 30 days

False Positive Rate
False Positive Rate
3

Needs investigation
False positive
Benign

Data Source by Severity
Data Source by Severity
12

Google Cloud Platform(210)
High(82)
Medium(34)
Low(72)
Informational(21)
N/A(1)
Amazon AWS(82)
Critical(2)
High(14)
Medium(35)
Low(30)
Informational(1)
Exaforce(56)
Critical(26)
High(26)
Medium(4)
Azure(40)
High(3)
Medium(5)
Low(6)
Informational(26)
Sentinel One(23)
Critical(1)
High(22)
GitHub(13)
Critical(3)
High(9)
Informational(1)
Google Workspace(9)
High(6)
Medium(1)
Low(2)
Microsoft 365(5)
High(2)
Medium(1)
Low(1)
Informational(1)
EKS(4)
High(4)
CrowdStrike(2)
High(2)
Okta(2)
High(1)
Medium(1)
OpenAI(1)
High(1)
Threat Findings
i18n_d2ab282bf4a4c92c3ad632840c9488d8
447

Group by

SeverityData SourceFinding Source
  • Nothing was found
Favorite
Favorite
Priority
Priority
Severity
Severity
Finding
Finding
SLA
SLA
Data Source
Data Source
Finding Source
Finding Source
Created At
Created At
Principal Name
Principal Name
Status
Status
Assignee
Assignee
Account
Account
Mitre Tactic
Mitre Tactic
Mitre Technique
Mitre Technique
Recommendation
Recommendation
Workflows
Workflows
N/A
Low
Persistence: New Geography
THREAT
THREAT

2d 17h left

Google Cloud Platform
Google Cloud Platform
68fcc4be78984488a4bacea988c5ad72
68fcc4be78984488a4bacea988c5ad72
SCC
SCC
GWS
GWS
6 hours ago
6 hours ago
asingla@exaforce.com
asingla@exaforce.com
Google Cloud Platform • User
Google Cloud Platform • User
Open
Select items...

N/A

N/A

N/A

Exabots at work
N/A
Low
Defense Evasion: Organization Policy Changed
OBSERVATION
OBSERVATION

2d 17h left

Google Cloud Platform
Google Cloud Platform
defd31b5078a4571858c85c229fbec08
defd31b5078a4571858c85c229fbec08
SCC
SCC
SESSION
SESSION
6 hours ago
6 hours ago
manish@exaforce.com
manish@exaforce.com
Google Cloud Platform • User
Google Cloud Platform • User
Open
Select items...

N/A

N/A

N/A

Exabots at work
P3
Medium
User jdoubek anomalously invoking Network ACL APIs from Slovakia
Persistence-EC2
Persistence-EC2

2d 15h left

Amazon AWS
Amazon AWS
bccc7b0153d7030296e4b2a1113c35c3
bccc7b0153d7030296e4b2a1113c35c3
GuardDuty
GuardDuty
8 hours ago
8 hours ago
jdoubek
jdoubek
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Persistence
Account Manipulation
False Positive
P3
Low
AssumedRole AWSReservedSSO_DemoAdministratorAccess_7a819cbf36a34d1f anomalously invoking Discovery APIs
Discovery-EC2
Discovery-EC2

2d 14h left

Amazon AWS
Amazon AWS
e2cc7affcb7a0db829170771473f14ed
e2cc7affcb7a0db829170771473f14ed
GuardDuty
GuardDuty
9 hours ago
9 hours ago
jdoubek
jdoubek
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Discovery
Account Discovery
False Positive
P3
Low
User nuno using SecurityAuditSSORole performing EC2 discovery APIs from unusual UK location
Discovery-EC2
Discovery-EC2

2d 12h left

Amazon AWS
Amazon AWS
dccc7ac9434cc9b6e2b0319813ed85af
dccc7ac9434cc9b6e2b0319813ed85af
GuardDuty
GuardDuty
11 hours ago
11 hours ago
nuno
nuno
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
157206707803
157206707803
exaforce
exaforce
Discovery
Cloud Infrastructure Discovery
False Positive
P3
Low
Discovery APIs invoked from unusual location Oxford, UK by AWSReservedSSO_DeveloperAccess_6e62fd91cde608ff
Discovery.IAM
Discovery.IAM

2d 12h left

Amazon AWS
Amazon AWS
30cc7ac94318897588ff44252e93df83
30cc7ac94318897588ff44252e93df83
GuardDuty
GuardDuty
11 hours ago
11 hours ago
nuno
nuno
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
157206707803
157206707803
exaforce
exaforce
Discovery
Account Discovery
Benign
N/A
Medium
Privilege Escalation: Anomalous Service Account Impersonator for Data Access
THREAT •
Duplicates: 79
Duplicates: 79
THREAT •
Duplicates: 79
Duplicates: 79

2d 13h left

Google Cloud Platform
Google Cloud Platform
9c28da7d2d5f4d528d90b4aa7a7c922a
9c28da7d2d5f4d528d90b4aa7a7c922a
SCC
SCC
SESSION
SESSION
11 hours ago
11 hours ago
aqil.isayev@exaforce.com
aqil.isayev@exaforce.com
Google Cloud Platform • User
Google Cloud Platform • User
Open
Select items...

N/A

N/A

N/A

Exabots at work
P3
High
IAM identity AWSControlTowerExecution anomalously invoking UpdateClusterConfig API from T-Mobile Czech Republic
Impact-EKS
Impact-EKS

2d 11h left

Amazon AWS
Amazon AWS
8acc7aad65b79b9f06c4f482d6cdb46d
8acc7aad65b79b9f06c4f482d6cdb46d
GuardDuty
GuardDuty
12 hours ago
12 hours ago
pcizinsky
pcizinsky
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
063299844220
063299844220
acme
acme
Impact
Data Manipulation
False Positive
P3
Medium
AWSControlTowerExecution role anomalously invoking CredentialAccess APIs from unobserved T-Mobile Czech ASN
Discovery-GUARDDUTY
Discovery-GUARDDUTY

2d 10h left

Amazon AWS
Amazon AWS
02cc7a8b96f7dffe707a30a5bc8620cf
02cc7a8b96f7dffe707a30a5bc8620cf
GuardDuty
GuardDuty
13 hours ago
13 hours ago
pcizinsky
pcizinsky
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
063299844220
063299844220
acme
acme
Credential Access
Valid Accounts
False Positive
P3
Low
AWSControlTowerExecution role performing discovery API calls from Prague, Czech Republic
Discovery-EC2
Discovery-EC2

2d 10h left

Amazon AWS
Amazon AWS
18cc7a8b96affe13f0632b6e8b237343
18cc7a8b96affe13f0632b6e8b237343
GuardDuty
GuardDuty
13 hours ago
13 hours ago
pcizinsky
pcizinsky
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
063299844220
063299844220
acme
acme
Discovery
Cloud Infrastructure Discovery
False Positive
N/A
Low
Added Library Loaded
THREAT •
Duplicates: 7
Duplicates: 7
THREAT •
Duplicates: 7
Duplicates: 7

2d 2h left

Google Cloud Platform
Google Cloud Platform
78b432c90af40dc5
78b432c90af40dc5
SCC
SCC
CWPP
CWPP
21 hours ago
21 hours ago

N/A

Open
Select items...
900805511621
900805511621
gke-poc-436808
gke-poc-436808

N/A

N/A

Exabots at work
P3
Info
Bleon Proko has anonymous IP address
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2

2d 1h left

Azure
Azure
36b60c0277b8682445e7f0f9257225b010478b975397547edb184c9383409832
36b60c0277b8682445e7f0f9257225b010478b975397547edb184c9383409832
IdentityProtection
IdentityProtection
23 hours ago
23 hours ago
bproko@exaforce.com
bproko@exaforce.com
Azure • EntraIDUser
Azure • EntraIDUser
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
exaforce.com
exaforce.com
Initial Access
Valid Accounts
False Positive
P3
Medium
Bleon Proko has anonymous IP address
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2

2d 1h left

Azure
Azure
e01f934c543acb0d596bb33a61b7b0c682831da17b2269594928eb18fabca73d
e01f934c543acb0d596bb33a61b7b0c682831da17b2269594928eb18fabca73d
IdentityProtection
IdentityProtection
23 hours ago
23 hours ago
bproko@exaforce.com
bproko@exaforce.com
Azure • EntraIDUser
Azure • EntraIDUser
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
exaforce.com
exaforce.com
Initial Access
Valid Accounts
False Positive
P3
Low
Added Library Loaded
DefenseEvasion-GCP •
Duplicates: 6
Duplicates: 6
DefenseEvasion-GCP •
Duplicates: 6
Duplicates: 6

1d 1h left

Google Cloud Platform
Google Cloud Platform
c4bd921ad36364eb
c4bd921ad36364eb
SCC
SCC
CWPP
CWPP
1 day ago
1 day ago

N/A

Open
Select items...
900805511621
900805511621
gke-poc-436808
gke-poc-436808
Defense Evasion
Process Injection
False Positive
P0
Critical
PowerShell Defense Evasion Leading to Mimikatz Credential Dumping on DESKTOP-AEDUDIR
AttackSequence-CredentialAccess •
Attack Chains: 2
Attack Chains: 2
AttackSequence-CredentialAccess •
Attack Chains: 2
Attack Chains: 2

1d 18h over

Exaforce
Exaforce
55590fcd-efb6-4c1e-b10f-abb344cece82
55590fcd-efb6-4c1e-b10f-abb344cece82
Exaforce
Exaforce
1 day ago
1 day ago

N/A

Open
Select items...

N/A

Credential Access
OS Credential Dumping
Needs Investigation
P3
Low
Discovery: Service Account Self-Investigation via GetIamPolicy
Discovery-GCP
Discovery-GCP

1d 1h left

Google Cloud Platform
Google Cloud Platform
c7f8f145ba3243499b126f211a558567
c7f8f145ba3243499b126f211a558567
SCC
SCC
SESSION
SESSION
1 day ago
1 day ago
exaforce-demo.svc.id.goog[token-steal/token-steal-ksa]
exaforce-demo.svc.id.goog[token-steal/token-steal-ksa]
Google Cloud Platform • K8sServiceAccount
Google Cloud Platform • K8sServiceAccount
Open
Select items...
203860640938
203860640938
exaforce-demo
exaforce-demo
Discovery
Permission Groups Discovery
False Positive
P0
Critical
SentinelOne EDR Detection: mimikatz.exe Infostealer Execution by BleonProko
CredentialAccess-SENTINELONE-EDR
CredentialAccess-SENTINELONE-EDR

1d 18h over

Sentinel One
Sentinel One
2291002556686151093
2291002556686151093
EDR
EDR
ENDPOINT
ENDPOINT
1 day ago
1 day ago
Bleon Proko
Bleon Proko
Sentinel One • EntraIDUser
Sentinel One • EntraIDUser
Open
Select items...
2230733644473162665
2230733644473162665
2230733644473162665
2230733644473162665
Credential Access
OS Credential Dumping
Needs Investigation
P1
High
powershell.exe (Interactive Session b5df) - Malware (malicious)
Execution-SENTINELONE-EDR
Execution-SENTINELONE-EDR

1d 15h over

Sentinel One
Sentinel One
2290986222766129008
2290986222766129008
EDR
EDR
ENDPOINT
ENDPOINT
1 day ago
1 day ago
Bleon Proko
Bleon Proko
Sentinel One • EntraIDUser
Sentinel One • EntraIDUser
Open
Select items...
2230733644473162665
2230733644473162665
2230733644473162665
2230733644473162665
Defense Evasion
Impair Defenses
Needs Investigation
P1
High
Sensitive kubectl exec access to GitHub Actions runner pod detected
Execution-EKS
Execution-EKS

1d 21h over

EKS
EKS
c08a8ee9-21c5-47e5-a0d3-64e0b2244070
c08a8ee9-21c5-47e5-a0d3-64e0b2244070
Exaforce
Exaforce
USER
USER
2 days ago
2 days ago
vdvorak
vdvorak
EKS • user
EKS • user
Open
Select items...
058264247462
058264247462
SaaS Dev
SaaS Dev
Execution
Container Administration Command
Needs Investigation
P2
Medium
Attempt to impersonate GCP Apps Script Project using sys-* naming pattern
DefenseEvasion-GCP
DefenseEvasion-GCP

1d 3h over

Google Cloud Platform
Google Cloud Platform
52fa0ccdc4c193fbbf716ed6d4bffc5c
52fa0ccdc4c193fbbf716ed6d4bffc5c
Exaforce
Exaforce
SESSION
SESSION
2 days ago
2 days ago
bproko@exaforce.com
bproko@exaforce.com
Google Cloud Platform • User
Google Cloud Platform • User
Open
Select items...
362884730784
362884730784
sys-59383487759595092331707023
sys-59383487759595092331707023
Defense Evasion
Masquerading
Needs Investigation
P3
Low
Richard Felkl has anonymous IP address
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2
InitialAccess-AZURE •
Duplicates: 2
Duplicates: 2

13h 46m left

13h 46m left

Azure
Azure
e313f242690e523294fb64f70e82c34386cee008741e46ca5c4dc85bd1360145
e313f242690e523294fb64f70e82c34386cee008741e46ca5c4dc85bd1360145
IdentityProtection
IdentityProtection
2 days ago
2 days ago
rfelkl@exaforce.com
rfelkl@exaforce.com
Azure • EntraIDUser
Azure • EntraIDUser
In Progress
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
exaforce.com
exaforce.com
Initial Access
Valid Accounts
False Positive
P1
Low
AWS CloudTrail trail arn:aws:cloudtrail:us-east-2:157206707803:trail/management-events was disabled
UnauthorizedAPICall:CloudTrail/LogDisabling
UnauthorizedAPICall:CloudTrail/LogDisabling

2d 9h over

Amazon AWS
Amazon AWS
64cc74fd602b7fa479106a08e4361f46
64cc74fd602b7fa479106a08e4361f46
GuardDuty
GuardDuty
2 days ago
2 days ago
AWSServiceRoleForCloudTrail
AWSServiceRoleForCloudTrail
Amazon AWS • AssumedRole
Amazon AWS • AssumedRole
Open
Select items...
782337784679
782337784679
invisibleai2
invisibleai2
Defense Evasion
Impair Defenses
Needs Investigation
P3
Low
User AssumedRole AWSReservedSSO_AdministratorAccess_77d3f656c0bb53aa anomalously invoking Discovery APIs
TTP.Discovery-AWS_API
TTP.Discovery-AWS_API

6h 56m left

6h 56m left

Amazon AWS
Amazon AWS
f2cc74fd1ea35c60ef268d573762cf5d
f2cc74fd1ea35c60ef268d573762cf5d
GuardDuty
GuardDuty
2 days ago
2 days ago
jpavlik
jpavlik
Amazon AWS • IDCUser
Amazon AWS • IDCUser
Open
Select items...
157206707803
157206707803
exaforce
exaforce
Discovery
Account Discovery
False Positive
P3
Low
Log4j Compromise Attempt from Japan Against GKE Load Balancer
InitialAccess-GCP
InitialAccess-GCP

5h 59m left

5h 59m left

Google Cloud Platform
Google Cloud Platform
49e5b5ca9de846a399517db1c62fde35
49e5b5ca9de846a399517db1c62fde35
SCC
SCC
NETWORK
NETWORK
2 days ago
2 days ago

N/A

Open
Select items...
668135935537
668135935537
shang-playground
shang-playground
Initial Access
Exploit Public-Facing Application
Benign
P3
Info
Discovery: Service Account Self-Investigation from Finland
Discovery-CLOUDRESOURCEMANAGER
Discovery-CLOUDRESOURCEMANAGER

4h 13m left

Google Cloud Platform
Google Cloud Platform
edceb0966d2f481a96291b26cb7d3c21
edceb0966d2f481a96291b26cb7d3c21
SCC
SCC
SESSION
SESSION
2 days ago
2 days ago
exaforce-demo.svc.id.goog[token-steal/token-steal-ksa]
exaforce-demo.svc.id.goog[token-steal/token-steal-ksa]
Google Cloud Platform • K8sServiceAccount
Google Cloud Platform • K8sServiceAccount
Open
Select items...
203860640938
203860640938
exaforce-demo
exaforce-demo
Discovery
Permission Groups Discovery
False Positive

of 18

Category by Data Source
i18n_64b3ed37f507fbfeb1bbfcfd25a4b9b1

Less
More
 (82)
 (40)
 (2)
 (4)
 (56)
 (210)
 (13)
 (9)
 (5)
 (2)
 (1)
 (23)
 Application (13)
1
0
0
0
0
10
1
1
0
0
0
0
 Data (19)
15
0
0
0
1
0
2
1
0
0
0
0
 Endpoint (9)
0
0
2
0
0
1
0
0
0
0
0
6
 Identity (270)
47
39
0
0
42
121
10
3
5
2
1
0
 Kubernetes (85)
3
0
0
4
7
71
0
0
0
0
0
0
 Malware (22)
0
0
0
0
5
0
0
0
0
0
0
17
 Network (16)
12
1
0
0
1
2
0
0
0
0
0
0
 Phishing (4)
0
0
0
0
0
0
0
4
0
0
0
0
 Secret (4)
4
0
0
0
0
0
0
0
0
0
0
0
 Others (5)
0
0
0
0
0
5
0
0
0
0
0
0
Exabot Search

Hello, Taylor

Exabot can make mistakes. Verify before making decisions.
Use shift+enter for new line

What events have occurred on resource 10e0aec0-a59f-4a34-b792-d2e5ab7b6c76 in the last 30 days?

Cloud Resources

What are the high severity threat findings in my environment?

Threat Findings

Show me all sessions with security findings in the last 7 days

Sessions

Show me all workflows and actions running in the vendor-cq-plugin-sdk repository

Code
Exabot Search