| elastic |
Potential CVE-2025-33053 Exploitation |
production |
2026-09-18 |
| elastic |
Tainted Out-Of-Tree Kernel Module Load |
production |
2026-09-18 |
| elastic |
Kernel Module Loaded with Tainting Flags |
production |
2026-09-18 |
| elastic |
Unusual City For an AWS Command |
production |
2026-09-18 |
| elastic |
Tainted Kernel Module Load |
production |
2026-09-18 |
| elastic |
Potential Linux Ransomware Note Creation Detected |
production |
2026-09-18 |
| elastic |
Rare AWS Error Code |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Memory Swap Modification |
production |
2026-09-18 |
| elastic |
Spike in AWS Error Messages |
production |
2026-09-18 |
| elastic |
Suspicious Termination of ESXI Process |
production |
2026-09-18 |
| elastic |
Suspicious Data Encryption via OpenSSL Utility |
production |
2026-09-18 |
| elastic |
AWS SNS Topic Message Publish by Rare User |
production |
2026-09-18 |
| elastic |
Potential System Tampering via File Modification |
production |
2026-09-18 |
| elastic |
File Transfer Utility Launched from Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Through Wget |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
Potential Database Dumping Activity |
production |
2026-09-18 |
| elastic |
Potential Data Splitting Detected |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-09-18 |
| elastic |
Unusual Pkexec Execution |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Interactive Shell Launched via Unusual Parent Process in a Container |
production |
2026-09-18 |
| elastic |
Suspicious Module Loaded by LSASS |
production |
2026-09-18 |
| elastic |
AWS SSM Session Started to EC2 Instance |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Unauthorized Scope for Public App OAuth2 Token Grant with Client Credentials |
production |
2026-09-18 |
| elastic |
Unix Socket Connection |
production |
2026-09-18 |
| elastic |
AWS Suspicious User Agent Fingerprint |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
System Binary Path File Permission Modification |
production |
2026-09-18 |
| elastic |
AWS Sign-In Console Login with Federated User |
production |
2026-09-18 |
| elastic |
WMI Incoming Lateral Movement |
production |
2026-09-18 |
| elastic |
XDG-Open Command Execution |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
AWS Sign-In Root Password Recovery Requested |
production |
2026-09-18 |
| elastic |
Suspicious Named Pipe Creation |
production |
2026-09-18 |