| elastic |
Unusual Kernel Module Enumeration |
production |
2026-09-18 |
| elastic |
Kernel Seeking Activity |
production |
2026-09-18 |
| elastic |
Kernel Unpacking Activity |
production |
2026-09-18 |
| elastic |
Kubeconfig File Discovery |
production |
2026-09-18 |
| elastic |
Hping Process Activity |
production |
2026-09-18 |
| elastic |
Nping Process Activity |
production |
2026-09-18 |
| elastic |
Manual Mount Discovery via /etc/exports or /etc/fstab |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Version Discovery |
production |
2026-09-18 |
| elastic |
Passwordless Sudo Probing |
production |
2026-09-18 |
| elastic |
Potential Network Scan Executed From Host |
production |
2026-09-18 |
| elastic |
Polkit Version Discovery |
production |
2026-09-18 |
| elastic |
Potential Port Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Private Key Searching Activity |
production |
2026-09-18 |
| elastic |
Suspicious /proc/maps Discovery |
production |
2026-09-18 |
| elastic |
Process Capability Enumeration |
production |
2026-09-18 |
| elastic |
Security File Access via Common Utilities |
production |
2026-09-18 |
| elastic |
Potential Subnet Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Sudo Command Enumeration Detected |
production |
2026-09-18 |
| elastic |
SUID/SGUID Enumeration Detected |
production |
2026-09-18 |
| elastic |
Suspicious Memory grep Activity |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launched Inside A Container |
production |
2026-09-18 |
| elastic |
Suspicious Reading of procfs Syscall File |
production |
2026-09-18 |
| elastic |
Suspicious which Enumeration |
production |
2026-09-18 |
| elastic |
Unusual Process Connection to Docker or Containerd Socket |
production |
2026-09-18 |
| elastic |
Unusual User Privilege Enumeration via id |
production |
2026-09-18 |
| elastic |
Yum/DNF Plugin Status Discovery |
production |
2026-09-18 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Suspicious Command Execution via Busybox Proxy |
production |
2026-09-18 |
| elastic |
Container Management Utility Run Inside A Container |
production |
2026-09-18 |
| elastic |
Container Runtime CLI Execution with Suspicious Arguments |
production |
2026-09-18 |
| elastic |
File Creation by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Printer User (lp) Shell Execution |
production |
2026-09-18 |
| elastic |
Cupsd or Foomatic-rip Shell Execution |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |