| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Windows Sandbox with Sensitive Configuration |
production |
2026-09-18 |
| elastic |
Unusual Child Processes of RunDLL32 |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Potential Windows Session Hijacking via CcmExec |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-09-18 |
| elastic |
Potential Secure File Deletion via SDelete Utility |
production |
2026-09-18 |
| elastic |
SIP Provider Modification |
production |
2026-09-18 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-09-18 |
| elastic |
Suspicious CertUtil Commands |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
PANW and Elastic Defend - Command and Control Correlation |
production |
2026-09-18 |
| elastic |
Curl or Wget Spawned via Node.js |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| elastic |
GitHub App Deleted |
production |
2026-09-18 |
| elastic |
Potential Account Takeover - Logon from New Source IP |
production |
2026-09-18 |
| elastic |
Remote Computer Account DnsHostName Update |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential Privileged Escalation via SamAccountName Spoofing |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Windir Environment Variable |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler SPL File Created |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler File Deletion |
production |
2026-09-18 |
| elastic |
Unusual Print Spooler Child Process |
production |
2026-09-18 |
| elastic |
Unusual Service Host Child Process - Childless Service |
production |
2026-09-18 |
| elastic |
Suspicious Print Spooler Point and Print DLL |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Privileges Elevation via Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Potential Port Monitor or Print Processor Registration Abuse |
production |
2026-09-18 |
| elastic |
Suspicious DLL Loaded for Persistence or Privilege Escalation |
production |
2026-09-18 |
| elastic |
Unsigned DLL loaded by DNS Service |
production |
2026-09-18 |
| elastic |
First Time Seen NewCredentials Logon Process |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Named Pipe Impersonation |
production |
2026-09-18 |
| elastic |
Potential Escalation via Vulnerable MSI Repair |
production |
2026-09-18 |
| elastic |
Interactive Logon by an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential LSA Authentication Package Abuse |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via InstallerFileTakeOver |
production |
2026-09-18 |
| elastic |
Unusual Parent-Child Relationship |
production |
2026-09-18 |