| elastic |
Credential Manipulation - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Dumping of Keychain Content via Security Command |
production |
2026-09-18 |
| elastic |
Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) |
production |
2026-09-18 |
| elastic |
Suspicious Process Access via Direct System Call |
production |
2026-09-18 |
| elastic |
Multiple Device Token Hashes for Single Okta Session |
production |
2026-09-18 |
| elastic |
Netcat Listener Established via rlwrap |
production |
2026-09-18 |
| elastic |
WebProxy Settings Modification |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Assigned to a User or Group |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score |
production |
2026-09-18 |
| elastic |
Kubernetes Secret Get or List with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Audio Capture Capabilities |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
Kubernetes and Cloud Credential Path Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Windows Defender Disabled via Registry Modification |
production |
2026-09-18 |
| elastic |
First-Time Destructive MongoDB Command from a Client IP |
production |
2026-09-18 |
| elastic |
Keychain CommandLine Interaction via Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Azure Blob Storage Permissions Modified |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
M365 SharePoint Malware File Detected |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
Untrusted Driver Loaded |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Alert Suppression Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Deprecated TLS Version or Weak Cipher Negotiated Externally |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
SentinelOne Alert External Alerts |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Entra ID AiTM Phishing-Kit Chain Detected |
production |
2026-09-18 |
| elastic |
Unusual Network Connection via RunDLL32 |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a User |
production |
2026-09-18 |
| elastic |
Kubernetes Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
Multiple Vault Web Credentials Read |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Azure AKS Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
Potential DNS Tunneling via NsLookup |
production |
2026-09-18 |
| elastic |
Potential Remote Credential Access via Registry |
production |
2026-09-18 |
| elastic |
Multiple Alerts in Same ATT&CK Tactic by Host |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |