Dropzone AI | AI SOC Analyst

Investigations

Show Closed

Start Time	ID	Alert	Entities	Source
Apr 29, 20261:38PM (PDT) 1 day ago	INV-687	Malicious Credential Harvesting Subject: Re: Login IssuesPhishing	Bucky Bennett <bucky.bennett@thisisarealcompany.com>Joe Phisherman <joephisherman@gmail.com>	Email
Apr 09, 20268:19PM (PDT) 21 days ago	INV-684	Benign High severity DLP exfiltration in email to emily.eaton@thisisarealcompany.comExfiltration	microsoft-noreply@microsoft.com	Microsoft Purview Data Loss Prevention (via Microsoft Defender Incident)More
Mar 25, 20264:52PM (PDT) 1 month ago	INV-683	Benign Mimikatz credential theft tool detected on Windows10 device desktop-finley Administrator userCredentialAccess	Administrator10.0.32.50desktop-finley	Microsoft Defender for Endpoint (via Microsoft Defender Incident)More
Mar 17, 20269:45PM (PDT) 1 month ago	INV-682	Malicious Compromised DESKTOP-FINLEY Administrator ran Mimikatz credential theft, hands-on-keyboard lateral movementLateralMovement	Administrator10.0.32.50desktop-finley	Microsoft Defender for Endpoint (via Microsoft Defender Incident)More
Apr 28, 20257:22AM (PDT) 1 year ago	INV-681	Malicious High‑risk phishing and dark web sites accessed by ethan@dropzone.ai不審なウェブ閲覧行為	ethan@dropzone.aimyetherrwollet.gitbook.io	Custom Alert
Apr 28, 20257:22AM (PDT) 1 year ago	INV-680	Malicious High‑risk phishing and dark web sites accessed by ethan@dropzone.ai不審なウェブ閲覧行為	ethan@dropzone.aimyetherrwollet.gitbook.io	Custom Alert
Mar 16, 20265:42PM (PDT) 1 month ago	INV-679	Malicious Blocked Activity Mimikatz credential theft tool detected on desktop-finley affecting Administrator accountCredentialAccess	Administrator10.0.32.50desktop-finley	Microsoft Defender for Endpoint (via Microsoft Defender Incident)More
Mar 09, 20265:47PM (PDT) 2 months ago	INV-678	Benign High‑severity DLP exfiltration of U.S. PII via invoice email to emily.eatonExfiltration	microsoft-noreply@microsoft.com	Microsoft Purview Data Loss Prevention (via Microsoft Defender Incident)More
Feb 16, 20266:20PM (PST) 2 months ago	INV-677	Malicious Fake Invoice Pretexting Lure Subject: IBIPhishing	demouser@thisisarealcompany.comRachel Collier <juanrivers200012@gmail.com>	Email
Feb 11, 20266:50PM (PST) 3 months ago	INV-676	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Apr 21, 202611:12AM (PDT) 9 days ago	INV-675	Malicious Credential Harvesting Subject: Phishing:2f1d1041-351a-40d8-e52a-08de9fd14b99\|tylerhoyt93@gmail.com\|(Re: Login Issues) 4/21/2026 6:12:11 PMPhishing Submission	emily.eaton@thisisarealcompany.com	Office 365 Phishing Mailbox
Mar 28, 20267:53PM (PDT) 1 month ago	INV-674	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Apr 04, 20269:20AM (PDT) 26 days ago	INV-673	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Mar 29, 20264:37PM (PDT) 1 month ago	INV-672	Benign Subject: Account past dueEmail	terriboyette@michelman.comdemouser@thisisarealcompany.com	Proofpoint
Mar 27, 20267:41PM (PDT) 1 month ago	INV-671	Benign Subject: Account past dueEmail	terriboyette@michelman.comdemouser@thisisarealcompany.com	Proofpoint
Apr 06, 20264:28AM (PDT) 24 days ago	INV-670	Malicious Atomic Red Team Blocked Activity + 1 Suspicious Processes Detected on CLOUD-WORKSTATI by AdministratorDetection / Execution	172.22.3.24052.35.62.248CLOUD-WORKSTATI	CrowdStrike
Feb 13, 20263:20PM (PST) 3 months ago	INV-669	Suspicious Terraform role InfrastructureAsCodeAdmin retrieved EC2 i-0dffc9f401dedd0b4 userData in us-east-1AWS EC2 User Data Retrieval for EC2 Instance	arn:aws:sts::260974044336:assumed-role/InfrastructureAsCodeAdmin/aws-go-sdk-1770786524753596576arn:aws:iam::260974044336:role/InfrastructureAsCodeAdmin	Elastic
Feb 25, 202610:53AM (PST) 2 months ago	INV-668	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Mar 10, 20262:19PM (PDT) 2 months ago	INV-667	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Mar 08, 202610:25AM (PDT) 2 months ago	INV-666	Benign Subject: Account past dueEmail	terriboyette@michelman.comdemouser@thisisarealcompany.com	Proofpoint
Mar 04, 202611:37AM (PST) 2 months ago	INV-665	Benign Subject: Account past dueEmail	terriboyette@michelman.comdemouser@thisisarealcompany.com	Proofpoint
Mar 10, 20264:36AM (PDT) 2 months ago	INV-664	Malicious Atomic Red Team Blocked Activity + 1 Suspicious Processes Detected on CLOUD-WORKSTATI by AdministratorDetection / Execution	172.22.3.24052.35.62.248CLOUD-WORKSTATI	CrowdStrike
Mar 03, 202612:44PM (PST) 2 months ago	INV-663	Benign Local member added to Builtin Administrators group on darth-server-soc2User Add/Remove in Windows Group	darth-server-soc2$Administrators	Elastic
Feb 19, 20267:31AM (PST) 2 months ago	INV-662	Benign First Secrets Manager access by InfrastructureAsCodeAdmin to knoesis-api_key in us-east-1First Time Seen AWS Secret Value Accessed in Secrets Manager	InfrastructureAsCodeAdminAROATZQ2D4SYFVTQD4WYQ:aws-go-sdk-1770991969218825672	Elastic
Feb 13, 20263:20PM (PST) 3 months ago	INV-661	Suspicious Terraform role InfrastructureAsCodeAdmin retrieved EC2 i-0dffc9f401dedd0b4 userData in us-east-1AWS EC2 User Data Retrieval for EC2 Instance	arn:aws:sts::260974044336:assumed-role/InfrastructureAsCodeAdmin/aws-go-sdk-1770786524753596576arn:aws:iam::260974044336:role/InfrastructureAsCodeAdmin	Elastic
Feb 24, 202610:58AM (PST) 2 months ago	INV-660	Benign Subject: Phishing:28592582-d6dd-40b7-53cb-08de65aab4e7\|MicrosoftExchange329e71ec88ae4615bbc36ab6ce41109e@thisisarealcompany.com\|(Undeliverable: Phishing:f489cb65-ce23-43b4-5e22-08de312b474e\|matt.hulse@g) 2/24/2026 6:58:52 PMPhishing Submission	emily.eaton@thisisarealcompany.com	Office 365 Phishing Mailbox
Feb 08, 20264:10PM (PST) 3 months ago	INV-659	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Feb 13, 20262:22AM (PST) 3 months ago	INV-658	Benign Subject: Account past dueEmail	terriboyette@michelman.comdemouser@thisisarealcompany.com	Proofpoint
Feb 13, 20263:20PM (PST) 3 months ago	INV-656	Suspicious Terraform role InfrastructureAsCodeAdmin retrieved EC2 i-0dffc9f401dedd0b4 userData in us-east-1AWS EC2 User Data Retrieval for EC2 Instance	arn:aws:sts::260974044336:assumed-role/InfrastructureAsCodeAdmin/aws-go-sdk-1770786524753596576arn:aws:iam::260974044336:role/InfrastructureAsCodeAdmin	Elastic
Feb 11, 20266:50PM (PST) 3 months ago	INV-655	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Feb 08, 20264:10PM (PST) 3 months ago	INV-654	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Feb 13, 20263:20PM (PST) 3 months ago	INV-651	Suspicious Terraform role InfrastructureAsCodeAdmin retrieved EC2 i-0dffc9f401dedd0b4 userData in us-east-1AWS EC2 User Data Retrieval for EC2 Instance	arn:aws:sts::260974044336:assumed-role/InfrastructureAsCodeAdmin/aws-go-sdk-1770786524753596576arn:aws:iam::260974044336:role/InfrastructureAsCodeAdmin	Elastic
Feb 11, 20266:50PM (PST) 3 months ago	INV-650	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Feb 08, 20264:10PM (PST) 3 months ago	INV-649	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Feb 11, 20266:50PM (PST) 3 months ago	INV-647	Benign Spam Email Subject: Our Automation Jumped the Gun: Here’s the Right Itential Insights for NovemberPhishing	<guy@dropzone.ai>"Itential Insights" <hello@itential.com>	Email
Feb 08, 20264:10PM (PST) 3 months ago	INV-646	Benign Spam Email Subject: Fw: You’re Training Hard… But Are You Training Smart?Phishing Submission	bucky.bennett@thisisarealcompany.com	Office 365 Phishing Mailbox
Apr 23, 202611:27PM (PDT) 7 days ago	INV-644	Benign Account Lockout Potential Misconfiguration Failed Login Attempts for Emily Eaton on Azure PortalCredentialAccess	emily.eaton@thisisarealcompany.com47.204.209.17	Microsoft SentinelMore
Apr 21, 202611:12AM (PDT) 9 days ago	INV-643	Benign Subject: Phishing:12c3cefe-e7b7-4afd-cf2a-08de9fd01685\|tylerhoyt93@gmail.com\|(Login Issues) 4/21/2026 6:12:11 PMPhishing Submission	emily.eaton@thisisarealcompany.com	Office 365 Phishing Mailbox
Apr 21, 202611:08AM (PDT) 9 days ago	INV-642	Suspicious Subject: Phishing:e321c08b-c22a-4bc9-3e2a-08de9fd00af3\|tylerhoyt93@gmail.com\|(Login Issues) 4/21/2026 6:08:57 PMPhishing Submission	harper.henderson@thisisarealcompany.com	Office 365 Phishing Mailbox
Apr 15, 202610:42AM (PDT) 15 days ago	INV-639	Benign Chris abella accessed sensitive website example.com without prior authorizationCustom Alert	Chris abellaexample.com	Custom Alert
Apr 13, 20269:32AM (PDT) 17 days ago	INV-638	Benign Okta high risk login for svc-account from Washington Virginia workstationgl_okta_successful_high_risk_user_logins	svc-accountsvc-account@tiarc.com	Google SecOps Alert
Apr 09, 20264:02AM (PDT) 21 days ago	INV-636	Benign Detection Testing Test Environment Suspicious PowerShell Activity Detected on Administrator AccountExecution	127.0.0.1	Microsoft SentinelMore
Apr 09, 20262:23AM (PDT) 22 days ago	INV-635	Malicious Compromised Administrator Account Used for Lateral Movement on desktop-finleyLateralMovement	Administrator10.0.32.50desktop-finley	Microsoft Defender for Endpoint (via Microsoft Defender Incident)More
Apr 08, 202611:56PM (PDT) 22 days ago	INV-634	Benign Blocked Activity Vulnerability Identified High Severity Ransomware Detected on Desktop1 EndpointWindowsDefenderAtp	52.205.115.8310.3.100.154desktop1	Microsoft SentinelMore
Apr 08, 202611:16PM (PDT) 22 days ago	INV-633	Benign Detection Testing Test Environment Suspicious PowerShell Activity Detected on EC2AMAZ-8S6KNBVMicrosoft Defender Incident	Administrator	Microsoft Defender Incident
Apr 08, 20268:26PM (PDT) 22 days ago	INV-632	Benign Blocked Activity Test Environment Active PSAttackTool Malware Blocked on PowerShellMalware	Administrator172.22.12.238malware-sandbox	Microsoft Defender for Endpoint
Apr 08, 20267:47PM (PDT) 22 days ago	INV-631	Benign EC2 Instance Communicating with Bitcoin-Related IP Addressd5659a5f-056b-43e3-a7fd-17f73715ee9b_ddc1b31b-9e39-4cc8-8477-893e2c94e6e8		Microsoft SentinelMore
Apr 08, 20266:04PM (PDT) 22 days ago	INV-629	Inconclusive EC2 Instance Communicating with Custom Threat List IPSuspiciousActivity		Microsoft Sentinel (via Microsoft Defender Incident)More
Apr 08, 20265:35PM (PDT) 22 days ago	INV-628	Benign Potential Misconfiguration EC2 Instance Communicating with Custom Threat IPd5659a5f-056b-43e3-a7fd-17f73715ee9b_ddc1b31b-9e39-4cc8-8477-893e2c94e6e8		Microsoft SentinelMore
Apr 08, 20261:11PM (PDT) 22 days ago	INV-627	Benign Excessive Traffic Detected From IP 23.243.142.319a025fc8-3739-4f93-818d-7dda210665f9_c489cb48-942b-4bf3-adb6-fedc2a1583ff	23.243.142.31	Microsoft Sentinel (via Custom Alert)

1-50 of 313 items