| elastic |
Suspicious WMI Event Subscription Created |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| elastic |
Potential Persistence via Time Provider Modification |
production |
2026-09-18 |
| elastic |
User Added to Privileged Group in Active Directory |
production |
2026-09-18 |
| elastic |
User Account Creation |
production |
2026-09-18 |
| elastic |
Potential Application Shimming via Sdbinst |
production |
2026-09-18 |
| elastic |
Persistence via BITS Job Notify Cmdline |
production |
2026-09-18 |
| elastic |
Persistence via Hidden Run Key Detected |
production |
2026-09-18 |
| elastic |
Installation of Security Support Provider |
production |
2026-09-18 |
| elastic |
Persistence via Update Orchestrator Service Hijack |
production |
2026-09-18 |
| elastic |
Persistence via WMI Event Subscription |
production |
2026-09-18 |
| elastic |
Persistence via WMI Standard Registry Provider |
production |
2026-09-18 |
| elastic |
Potential IIS Web Shell File Creation |
production |
2026-09-18 |
| elastic |
Werfault ReflectDebugger Persistence |
production |
2026-09-18 |
| elastic |
Potential Account Takeover - Mixed Logon Types |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |
| elastic |
Process Creation via Secondary Logon |
production |
2026-09-18 |
| elastic |
Process Created with a Duplicated Token |
production |
2026-09-18 |
| elastic |
Modification of the msPKIAccountCredentials |
production |
2026-09-18 |
| elastic |
Disabling User Account Control via Registry Modification |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
Unsigned DLL loaded by DNS Service |
production |
2026-09-18 |
| elastic |
First Time Seen Driver Loaded |
production |
2026-09-18 |
| elastic |
Expired or Revoked Driver Loaded |
production |
2026-09-18 |
| elastic |
Potential privilege escalation via CVE-2022-38028 |
production |
2026-09-18 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
Startup/Logon Script added to Group Policy Object |
production |
2026-09-18 |
| elastic |
Group Policy Abuse for Privilege Addition |
production |
2026-09-18 |
| elastic |
Scheduled Task Execution at Scale via GPO |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via InstallerFileTakeOver |
production |
2026-09-18 |
| elastic |
Service Creation via Local Kerberos Authentication |
production |
2026-09-18 |
| elastic |
Potential LSA Authentication Package Abuse |
production |
2026-09-18 |
| elastic |
Interactive Logon by an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Escalation via Vulnerable MSI Repair |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
First Time Seen NewCredentials Logon Process |
production |
2026-09-18 |
| elastic |
Suspicious DLL Loaded for Persistence or Privilege Escalation |
production |
2026-09-18 |
| elastic |
Potential Port Monitor or Print Processor Registration Abuse |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler Point and Print DLL |
production |
2026-09-18 |