| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
File Permission Modification in Writable Directory |
production |
2026-09-18 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Background Process |
production |
2026-09-18 |
| elastic |
Openssl Client or Server Activity |
production |
2026-09-18 |
| elastic |
Hidden Directory Creation via Unusual Parent |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| elastic |
Potential Code Execution via Postgresql |
production |
2026-09-18 |
| elastic |
Creation of Hidden Files and Directories via CommandLine |
production |
2026-09-18 |
| elastic |
Creation of Hidden Shared Object File |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
PANW and Elastic Defend - Command and Control Correlation |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Kernel Module Removal |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Kubernetes API Request Impersonating Privileged Identity |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
Web Server Spawned via Python |
production |
2026-09-18 |
| elastic |
System Log File Deletion |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Python |
production |
2026-09-18 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-09-18 |
| elastic |
Binary Executed from Shared Memory Directory |
production |
2026-09-18 |
| elastic |
Potential Hidden Process via Mount Hidepid |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Process Started from Process ID (PID) File |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via PRoot |
production |
2026-09-18 |
| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Process Name Stomping with Prctl |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| elastic |
Root Certificate Installation |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Perl |
production |
2026-09-18 |
| elastic |
SELinux Configuration Creation or Renaming |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Shell History Clearing via Environment Variables |
production |
2026-09-18 |