| elastic |
GCP IAM Role Deletion |
production |
2026-09-18 |
| elastic |
GKE CoreDNS or Kube-DNS Configuration Modified |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Modification |
production |
2026-09-18 |
| elastic |
GKE User Exec into Pod |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
GKE Pod Exec with Curl or Wget to HTTPS |
production |
2026-09-18 |
| elastic |
GKE Forbidden Request from Unusual User Agent |
production |
2026-09-18 |
| elastic |
GKE Forbidden Creation Request |
production |
2026-09-18 |
| elastic |
GKE Anonymous Pod Create/Update/Patch |
production |
2026-09-18 |
| elastic |
GCP Secret Manager ListSecrets Across Multiple Projects |
production |
2026-09-18 |
| elastic |
GKE Suspicious Self-Subject Review via Service Account |
production |
2026-09-18 |
| elastic |
GKE Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
GKE Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GKE Anonymous Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Deletion |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Route Creation |
production |
2026-09-18 |
| elastic |
GCP Virtual Private Cloud Network Deletion |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Permissions Modification |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Configuration Modification |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Deletion |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Subscription Deletion |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Deletion |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual ISO Code |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Recommended Monitor |
production |
2026-09-18 |
| elastic |
CyberArk Privileged Access Security Error |
production |
2026-09-18 |
| elastic |
Namespace Manipulation Using Unshare in a Container |
production |
2026-09-18 |
| elastic |
Potential release_agent Container Escape Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential notify_on_release Container Escape Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Nsenter Execution with Target Flag Inside Container |
production |
2026-09-18 |
| elastic |
Mount Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
DebugFS Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Chroot Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Process Killing Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Tool Installation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Execution Permission Modification Detected via Defend for Containers |
production |
2026-09-18 |