| elastic |
User Added to the Admin Group |
production |
2026-09-18 |
| elastic |
DNS Tunneling |
production |
2026-09-18 |
| elastic |
Unusual Web Request |
production |
2026-09-18 |
| elastic |
Unusual Web User Agent |
production |
2026-09-18 |
| elastic |
Unusual DNS Activity |
production |
2026-09-18 |
| elastic |
Spike in Failed Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Successful Logon Events from a Source IP |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Linux User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Login Activity |
production |
2026-09-18 |
| elastic |
Unusual Windows Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Windows User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Linux System Information Discovery Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Configuration Discovery |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Connection Discovery |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Discovery Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux User Discovery Activity |
production |
2026-09-18 |
| elastic |
Suspicious Powershell Script |
production |
2026-09-18 |
| elastic |
Rare Powershell Script |
production |
2026-09-18 |
| elastic |
Unusual Hour for a User to Logon |
production |
2026-09-18 |
| elastic |
Unusual Source IP for a User to Logon from |
production |
2026-09-18 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Unusual Linux Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Remote User |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Port Activity |
production |
2026-09-18 |
| elastic |
Decline in host-based traffic |
production |
2026-09-18 |
| elastic |
First Seen SonicWall Remote Access Login by User and Source |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Login from Multiple IP Addresses |
production |
2026-09-18 |
| elastic |
Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) |
production |
2026-09-18 |
| elastic |
Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell) |
production |
2026-09-18 |
| elastic |
React2Shell (CVE-2025-55182) Exploitation Attempt |
production |
2026-09-18 |
| elastic |
React2Shell Network Security Alert |
production |
2026-09-18 |
| elastic |
Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence |
production |
2026-09-18 |
| elastic |
Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts |
production |
2026-09-18 |