| elastic |
User Added to the Admin Group |
production |
2026-09-18 |
| elastic |
Azure VNet Firewall Policy Deleted |
production |
2026-09-18 |
| elastic |
Web Server Local File Inclusion Activity |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Unusual Linux System Information Discovery Activity |
production |
2026-09-18 |
| elastic |
Potential Git CVE-2025-48384 Exploitation |
production |
2026-09-18 |
| elastic |
Security Software Discovery via Grep |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
Entra ID ROPC Authentication with Unknown Client ID |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Created Then Deleted by Same Identity |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Configuration Discovery |
production |
2026-09-18 |
| elastic |
Entra ID User Added as Service Principal Owner |
production |
2026-09-18 |
| elastic |
Behavior - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Ransomware - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Linux User or Group Deletion |
production |
2026-09-18 |
| elastic |
AWS EKS Access Entry Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Items Accessed Excessively |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Replicated to Another Account |
production |
2026-09-18 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
AWS Secrets Manager Rapid Secrets Retrieval |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
Unusual Remote File Directory |
production |
2026-09-18 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Deleted |
production |
2026-09-18 |
| elastic |
Microsoft Sentinel External Alerts |
production |
2026-09-18 |
| elastic |
Unusual Command Execution via Web Server |
production |
2026-09-18 |
| elastic |
GitHub UEBA - Multiple Alerts from a GitHub Account |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Persistence via Suspicious Launch Agent or Launch Daemon |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
New GitHub Self Hosted Action Runner |
production |
2026-09-18 |
| elastic |
Unusual Remote File Extension |
production |
2026-09-18 |
| elastic |
M365 Exchange Malware Filter Policy Deleted |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual IP Address |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Rule with Obfuscated Name |
production |
2026-09-18 |