| elastic |
Suspicious Network Activity to the Internet by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Linux Telegram API Request |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via EarthWorm |
production |
2026-09-18 |
| elastic |
Sensitive Identity File Open by Suspicious Process via Auditd |
production |
2026-09-18 |
| elastic |
AWS Credentials Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression Inside A Container |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Unshadow |
production |
2026-09-18 |
| elastic |
Linux init (PID 1) Secret Dump via GDB |
production |
2026-09-18 |
| elastic |
Linux Process Hooking via GDB |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Kubernetes and Cloud Credential Path Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Secret Access |
production |
2026-09-18 |
| elastic |
Manual Memory Dumping via Proc Filesystem |
production |
2026-09-18 |
| elastic |
Potential Linux Local Account Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential External Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Potential Password Spraying Attack via SSH |
production |
2026-09-18 |
| elastic |
Potential Successful SSH Brute Force Attack |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Proc Filesystem |
production |
2026-09-18 |
| elastic |
Segfault from Sensitive Process Detected |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Potential SSH Password Grabbing via strace |
production |
2026-09-18 |
| elastic |
Access Control List Modification via setfacl |
production |
2026-09-18 |
| elastic |
Suspicious Write Attempt to AppArmor Policy Management Files |
production |
2026-09-18 |
| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
Proxy Shell Execution via Busybox |
production |
2026-09-18 |
| elastic |
File made Immutable by Chattr |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |