| elastic |
Creation of Hidden Login Item via Apple Script |
production |
2026-09-18 |
| elastic |
Launch Service Creation and Immediate Loading |
production |
2026-09-18 |
| elastic |
Suspicious Apple Mail Rule Plist Modification |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
Virtual Private Network Connection Attempt |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Remote SSH Login Enabled via systemsetup Command |
production |
2026-09-18 |
| elastic |
Attempt to Mount SMB Share via Command Line |
production |
2026-09-18 |
| elastic |
Potential Kerberos Attack via Bifrost |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
SSFileCopySender Executed as Root |
production |
2026-09-18 |
| elastic |
Unusual Library Load via Python |
production |
2026-09-18 |
| elastic |
Shell Execution via Apple Scripting |
production |
2026-09-18 |
| elastic |
Apple Script Execution followed by Network Connection |
production |
2026-09-18 |
| elastic |
Suspicious Automator Workflows Execution |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Execution via Electron Child Process Node.js Module |
production |
2026-09-18 |
| elastic |
Enumeration of Users or Groups via Built-in Commands |
production |
2026-09-18 |
| elastic |
System and Network Configuration Check |
production |
2026-09-18 |
| elastic |
Suspicious SIP Check by macOS Application |
production |
2026-09-18 |
| elastic |
Full Disk Access Permission Check |
production |
2026-09-18 |
| elastic |
External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
DNS Request for IP Lookup Service via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
TCC Bypass via Mounted APFS Snapshot Access |
production |
2026-09-18 |
| elastic |
Suspicious TCC Access Granted for User Folders |
production |
2026-09-18 |
| elastic |
Potential Microsoft Office Sandbox Evasion |
production |
2026-09-18 |
| elastic |
Modification of Safari Settings via Defaults Command |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via Localhost Secure Copy |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via TCCDB Modification |
production |
2026-09-18 |
| elastic |
Modification of Environment Variable via Unsigned or Untrusted Parent |
production |
2026-09-18 |
| elastic |
Attempt to Install Root Certificate |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Dylib Injection via Process Environment Variables |
production |
2026-09-18 |
| elastic |
Attempt to Disable Gatekeeper |
production |
2026-09-18 |
| elastic |
Quarantine Attrib Removed by Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |
| elastic |
SystemKey Access via Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Web Browser Sensitive File Access |
production |
2026-09-18 |