| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via PRoot |
production |
2026-09-18 |
| elastic |
Potential Process Name Stomping with Prctl |
production |
2026-09-18 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| elastic |
Root Certificate Installation |
production |
2026-09-18 |
| elastic |
SELinux Configuration Creation or Renaming |
production |
2026-09-18 |
| elastic |
Shell History Clearing via Environment Variables |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
Potentially Suspicious Process Started via tmux or screen |
production |
2026-09-18 |
| elastic |
Suspicious Path Mounted |
production |
2026-09-18 |
| elastic |
System Binary Symlink to Suspicious Location |
production |
2026-09-18 |
| elastic |
Suspicious Kernel Feature Activity |
production |
2026-09-18 |
| elastic |
Unusual Kill Signal |
production |
2026-09-18 |
| elastic |
Unusual Preload Environment Variable Process Execution |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Linux External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
System Information Discovery via dmidecode from Parent Shell |
production |
2026-09-18 |
| elastic |
Docker Socket Enumeration |
production |
2026-09-18 |
| elastic |
Suspicious Dynamic Linker Discovery via od |
production |
2026-09-18 |
| elastic |
ESXI Discovery via Find |
production |
2026-09-18 |
| elastic |
ESXI Discovery via Grep |
production |
2026-09-18 |
| elastic |
Kernel Instrumentation Discovery via kprobes and tracefs |
production |
2026-09-18 |
| elastic |
Unusual Kernel Module Enumeration |
production |
2026-09-18 |
| elastic |
Kernel Seeking Activity |
production |
2026-09-18 |
| elastic |
Kernel Unpacking Activity |
production |
2026-09-18 |
| elastic |
Kubeconfig File Discovery |
production |
2026-09-18 |
| elastic |
Hping Process Activity |
production |
2026-09-18 |
| elastic |
Nping Process Activity |
production |
2026-09-18 |
| elastic |
Manual Mount Discovery via /etc/exports or /etc/fstab |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Version Discovery |
production |
2026-09-18 |
| elastic |
Passwordless Sudo Probing |
production |
2026-09-18 |
| elastic |
Potential Network Scan Executed From Host |
production |
2026-09-18 |
| elastic |
Polkit Version Discovery |
production |
2026-09-18 |
| elastic |
Potential Port Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Private Key Searching Activity |
production |
2026-09-18 |
| elastic |
Suspicious /proc/maps Discovery |
production |
2026-09-18 |
| elastic |
Process Capability Enumeration |
production |
2026-09-18 |
| elastic |
Security File Access via Common Utilities |
production |
2026-09-18 |