| elastic |
Potential Hidden Process via Mount Hidepid |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Kubernetes Static Pod Manifest File Access |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Potential Linux Backdoor User Account Creation |
production |
2026-09-18 |
| elastic |
Linux Group Creation |
production |
2026-09-18 |
| elastic |
Linux User Added to Privileged Group |
production |
2026-09-18 |
| elastic |
Loadable Kernel Module Configuration File Creation |
production |
2026-09-18 |
| elastic |
Manual Dracut Execution |
production |
2026-09-18 |
| elastic |
Message-of-the-Day (MOTD) File Creation |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
OpenSSL Password Hash Generation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module or Configuration Creation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Creation in Unusual Directory |
production |
2026-09-18 |
| elastic |
Potential Backdoor Execution Through PAM_EXEC |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Source Download |
production |
2026-09-18 |
| elastic |
Polkit Policy Creation |
production |
2026-09-18 |
| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Process Capability Set via setcap Utility |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
Suspicious rc.local Error Message |
production |
2026-09-18 |
| elastic |
Potential Execution of rc.local Script |
production |
2026-09-18 |
| elastic |
rc.local/rc.common File Creation |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Setcap setuid/setgid Capability Set |
production |
2026-09-18 |
| elastic |
Shadow File Modification by Unusual Process |
production |
2026-09-18 |
| elastic |
Shared Object Created by Previously Unknown Process |
production |
2026-09-18 |
| elastic |
Shell Configuration Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Systemd Service Override Configuration File Created |
production |
2026-09-18 |