| elastic |
Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via UDP |
production |
2026-09-18 |
| elastic |
Suspicious Content Extracted or Decompressed via Funzip |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Suspicious Mining Process Creation Event |
production |
2026-09-18 |
| elastic |
Suspicious Named Pipe Creation |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
XDG-Open Command Execution |
production |
2026-09-18 |
| elastic |
System Binary Path File Permission Modification |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
Unix Socket Connection |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Interactive Shell Launched via Unusual Parent Process in a Container |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
Unusual Pkexec Execution |
production |
2026-09-18 |
| elastic |
Potential Data Splitting Detected |
production |
2026-09-18 |
| elastic |
Potential Database Dumping Activity |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration Through Wget |
production |
2026-09-18 |
| elastic |
File Transfer Utility Launched from Unusual Parent |
production |
2026-09-18 |
| elastic |
Suspicious Data Encryption via OpenSSL Utility |
production |
2026-09-18 |
| elastic |
Suspicious Termination of ESXI Process |
production |
2026-09-18 |
| elastic |
Memory Swap Modification |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Potential Linux Ransomware Note Creation Detected |
production |
2026-09-18 |
| elastic |
Kubernetes Static Pod Manifest File Access |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Potential Linux Backdoor User Account Creation |
production |
2026-09-18 |
| elastic |
Linux Group Creation |
production |
2026-09-18 |
| elastic |
Linux User Added to Privileged Group |
production |
2026-09-18 |
| elastic |
Loadable Kernel Module Configuration File Creation |
production |
2026-09-18 |
| elastic |
Manual Dracut Execution |
production |
2026-09-18 |
| elastic |
Message-of-the-Day (MOTD) File Creation |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
OpenSSL Password Hash Generation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module or Configuration Creation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Creation in Unusual Directory |
production |
2026-09-18 |
| elastic |
Potential Backdoor Execution Through PAM_EXEC |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Source Download |
production |
2026-09-18 |