| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-09-18 |
| elastic |
File Permission Modification in Writable Directory |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
File Creation in World-Writable Directory by Unusual Process |
production |
2026-09-18 |
| elastic |
Process Execution Followed by Self-Deletion |
production |
2026-09-18 |
| elastic |
ESXI Timestomping using Touch Command |
production |
2026-09-18 |
| elastic |
Dynamic Linker Creation |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via Doas |
production |
2026-09-18 |
| elastic |
Potential Disabling of SELinux |
production |
2026-09-18 |
| elastic |
Potential Disabling of AppArmor |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
Hidden Files and Directories via Hidden Flag |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |
| elastic |
File made Immutable by Chattr |
production |
2026-09-18 |
| elastic |
Proxy Shell Execution via Busybox |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
Suspicious Write Attempt to AppArmor Policy Management Files |
production |
2026-09-18 |
| elastic |
Access Control List Modification via setfacl |
production |
2026-09-18 |
| elastic |
Potential SSH Password Grabbing via strace |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a Host |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Privilege Type assigned to a User |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Spike in Special Logon Events |
production |
2026-09-18 |