| elastic |
Potential Data Exfiltration Activity to an Unusual Destination Port |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Activity to an Unusual Region |
production |
2026-09-18 |
| elastic |
Spike in Bytes Sent to an External Device |
production |
2026-09-18 |
| elastic |
Spike in Bytes Sent to an External Device via Airdrop |
production |
2026-09-18 |
| elastic |
Unusual Process Writing Data to an External Device |
production |
2026-09-18 |
| elastic |
Machine Learning Detected DGA activity using a known SUNBURST DNS domain |
production |
2026-09-18 |
| elastic |
Potential DGA Activity |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request With a High DGA Probability Score |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a DNS Request Predicted to be a DGA Domain |
production |
2026-09-18 |
| elastic |
Memory Threat - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Memory Threat - Prevented- Elastic Defend |
production |
2026-09-18 |
| elastic |
Endpoint Security (Elastic Defend) |
production |
2026-09-18 |
| elastic |
Behavior - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Behavior - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Malicious File - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Malicious File - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Ransomware - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Ransomware - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Entra ID Phishing Kit Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Entra ID Device with ROADtools Default OS Build (Entity Analytics) |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Subscription Creation |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Creation |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Cloud Instance Metadata Access |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Sensitive File or Credential Path Access |
production |
2026-09-18 |
| elastic |
GKE Rapid Secret GET Activity Against Multiple Objects |
production |
2026-09-18 |
| elastic |
GKE Secret Access from Node or Denied Service Account |
production |
2026-09-18 |
| elastic |
GKE Secret get or list with Suspicious User Agent |
production |
2026-09-18 |
| elastic |
GKE Secret Access via Unusual User Agent |
production |
2026-09-18 |
| elastic |
GKE Secrets List from Unusual Source AS Organization |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Creation |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Deletion |
production |
2026-09-18 |
| elastic |
GCP Firewall Rule Modification |
production |
2026-09-18 |
| elastic |
GCP Logging Bucket Deletion |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostIPC |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostNetwork |
production |
2026-09-18 |
| elastic |
GKE Pod Created With HostPID |
production |
2026-09-18 |
| elastic |
GKE Privileged Pod Created |
production |
2026-09-18 |
| elastic |
GKE RBAC Wildcard Elevation on Existing Role |
production |
2026-09-18 |
| elastic |
GKE Pod Created with a Sensitive hostPath Volume |
production |
2026-09-18 |