| elastic |
Elastic Agent Service Terminated |
production |
2026-09-18 |
| elastic |
ROT Encoded Python Script Execution |
production |
2026-09-18 |
| elastic |
First Seen Network Flow Exporter Followed by Suspicious Source Activity |
production |
2026-09-18 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Potential HTTP Downgrade Attack |
production |
2026-09-18 |
| elastic |
Potential Impersonation Attempt via Kubectl |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Processes with Trailing Spaces |
production |
2026-09-18 |
| elastic |
Unusual Country For a GCP Event |
production |
2026-09-18 |
| elastic |
Unusual City For a GCP Event |
production |
2026-09-18 |
| elastic |
Rare GCP Audit Failure Event Code |
production |
2026-09-18 |
| elastic |
Spike in GCP Audit Failed Messages |
production |
2026-09-18 |
| elastic |
GCP IAM Custom Role Creation |
production |
2026-09-18 |
| elastic |
GKE Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
GCP Storage Bucket Deletion |
production |
2026-09-18 |
| elastic |
Command Line Obfuscation via Whitespace Padding |
production |
2026-09-18 |
| elastic |
Kubectl Permission Discovery |
production |
2026-09-18 |
| elastic |
Kubectl Secrets Enumeration Across All Namespaces |
production |
2026-09-18 |
| elastic |
Security Software Discovery via Grep |
production |
2026-09-18 |
| elastic |
Virtual Machine Fingerprinting via Grep |
production |
2026-09-18 |
| elastic |
Web Server Local File Inclusion Activity |
production |
2026-09-18 |
| elastic |
Web Server Potential Remote File Inclusion Activity |
production |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` with Run Shell Command Parameters |
production |
2026-09-18 |
| elastic |
AWS SSM Session Manager Child Process Execution |
production |
2026-09-18 |
| elastic |
Azure Run Command Script Child Process |
production |
2026-09-18 |
| elastic |
Azure Run Command Correlated with Process Execution |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Common Utilities |
production |
2026-09-18 |
| elastic |
GCP Service Account Disabled |
production |
2026-09-18 |
| elastic |
GCP Service Account Deletion |
production |
2026-09-18 |
| elastic |
GCP IAM Role Deletion |
production |
2026-09-18 |
| elastic |
GKE CoreDNS or Kube-DNS Configuration Modified |
production |
2026-09-18 |
| elastic |
GCP Logging Sink Modification |
production |
2026-09-18 |
| elastic |
GKE User Exec into Pod |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Forbidden Direct Interactive Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Potential Git CVE-2025-48384 Exploitation |
production |
2026-09-18 |