| elastic |
Unusual Linux Network Configuration Discovery |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Connection Discovery |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Discovery Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux User Discovery Activity |
production |
2026-09-18 |
| elastic |
Suspicious Powershell Script |
production |
2026-09-18 |
| elastic |
Rare Powershell Script |
production |
2026-09-18 |
| elastic |
Unusual Hour for a User to Logon |
production |
2026-09-18 |
| elastic |
Unusual Source IP for a User to Logon from |
production |
2026-09-18 |
| elastic |
Rare User Logon |
production |
2026-09-18 |
| elastic |
Unusual Linux Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Username |
production |
2026-09-18 |
| elastic |
Unusual Windows Remote User |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Activity |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Port Activity |
production |
2026-09-18 |
| elastic |
Decline in host-based traffic |
production |
2026-09-18 |
| elastic |
First Seen SonicWall Remote Access Login by User and Source |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Login from Multiple IP Addresses |
production |
2026-09-18 |
| elastic |
Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) |
production |
2026-09-18 |
| elastic |
Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell) |
production |
2026-09-18 |
| elastic |
React2Shell (CVE-2025-55182) Exploitation Attempt |
production |
2026-09-18 |
| elastic |
React2Shell Network Security Alert |
production |
2026-09-18 |
| elastic |
Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence |
production |
2026-09-18 |
| elastic |
Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts |
production |
2026-09-18 |
| elastic |
Thrift RPC Method from an External Client |
production |
2026-09-18 |
| elastic |
Inbound Connection to an Unsecure Elasticsearch Node |
production |
2026-09-18 |
| elastic |
Abnormally Large DNS Response |
production |
2026-09-18 |
| elastic |
FortiGate Administrator Account Creation from Unusual Source |
production |
2026-09-18 |
| elastic |
FortiGate SSO Login Followed by Administrator Account Creation |
production |
2026-09-18 |
| elastic |
FortiGate Super Admin Account Creation |
production |
2026-09-18 |
| elastic |
MySQL User-Defined Function Injection |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET Cron Directory Persistence (RedisRaider) |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET SSH Authorized Key Injection |
production |
2026-09-18 |
| elastic |
Credential Dumping - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Credential Dumping - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
CrowdStrike External Alerts |
production |
2026-09-18 |
| elastic |
Elastic Security External Alerts |
production |
2026-09-18 |
| elastic |
Adversary Behavior - Detected - Elastic Endgame |
production |
2026-09-18 |