| elastic |
UAC Bypass via ICMLuaUtil Elevated COM Interface |
production |
2026-09-18 |
| elastic |
UAC Bypass via DiskCleanup Scheduled Task Hijack |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Privileged IFileOperation COM Interface |
production |
2026-09-18 |
| elastic |
Bypass UAC via Event Viewer |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Windows Directory Masquerading |
production |
2026-09-18 |
| elastic |
UAC Bypass via Windows Firewall Snap-In Hijack |
production |
2026-09-18 |
| elastic |
Potential Exploitation of an Unquoted Service Path Vulnerability |
production |
2026-09-18 |
| elastic |
Unusual Parent-Child Relationship |
production |
2026-09-18 |
| elastic |
Unusual Print Spooler Child Process |
production |
2026-09-18 |
| elastic |
Unusual Service Host Child Process - Childless Service |
production |
2026-09-18 |
| elastic |
Privileges Elevation via Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Rogue Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
Process Created with an Elevated Token |
production |
2026-09-18 |
| elastic |
Windows Service Installed via an Unusual Client |
production |
2026-09-18 |
| elastic |
AWS S3 Unauthenticated Bucket Access by Rare Source |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket ACL Modified to Allow Public Access by New Identity |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Created |
production |
2026-09-18 |
| elastic |
Trap Signals Execution |
production |
2026-09-18 |
| elastic |
Web Server Discovery or Fuzzing Activity |
production |
2026-09-18 |
| elastic |
Web Server Suspicious User Agent Requests |
production |
2026-09-18 |
| elastic |
Web Server Potential Spike in Error Response Codes |
production |
2026-09-18 |
| elastic |
Potential Spike in Web Server Error Logs |
production |
2026-09-18 |
| elastic |
Active Directory Forced Authentication from Linux Host - SMB Named Pipes |
production |
2026-09-18 |
| elastic |
Sudoers File Activity |
production |
2026-09-18 |
| elastic |
AWS IAM User Addition to Group |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance or Cluster Deletion Protection Disabled |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key First Seen from Source IP |
production |
2026-09-18 |
| elastic |
Newly Observed High Severity Suricata Alert |
production |
2026-09-18 |
| elastic |
Bash Shell Profile Modification |
production |
2026-09-18 |
| elastic |
AWS IAM Long-Term Access Key Correlated with Elevated Detection Alerts |
production |
2026-09-18 |
| elastic |
AWS IAM CompromisedKeyQuarantine Policy Attached to User |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Activity |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
AWS S3 Credential File Retrieved from Bucket |
production |
2026-09-18 |
| elastic |
Web Server Potential SQL Injection Request |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Sudoers File Modification |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
SUID/SGID Bit Set |
production |
2026-09-18 |
| elastic |
AWS Cognito Unauthenticated Identity Pool Credentials Issued |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |