| elastic |
Suspicious UID Change to Root via Python |
production |
2026-09-18 |
| elastic |
GitHub Repository Deleted |
production |
2026-09-18 |
| elastic |
Kernel Seeking Activity |
production |
2026-09-18 |
| elastic |
Control Panel Process with Unusual Arguments |
production |
2026-09-18 |
| elastic |
Okta Sign-In Events via Third-Party IdP |
production |
2026-09-18 |
| elastic |
Persistence via Folder Action Script |
production |
2026-09-18 |
| elastic |
Code Signing Policy Modification Through Registry |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
AWS AssumeRoleWithWebIdentity from Kubernetes SA and External ASN |
production |
2026-09-18 |
| elastic |
Systemd Timer Created |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Namespace Manipulation Using Unshare in a Container |
production |
2026-09-18 |
| elastic |
Systemd Service Created |
production |
2026-09-18 |
| elastic |
Hping Process Activity |
production |
2026-09-18 |
| elastic |
Unusual AWS S3 Object Encryption with SSE-C |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| elastic |
Unusual Hour for a User to Logon |
production |
2026-09-18 |
| elastic |
Svchost spawning Cmd |
production |
2026-09-18 |
| elastic |
Nping Process Activity |
production |
2026-09-18 |
| elastic |
Suspicious Command Prompt Network Connection |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Downloaded Shortcut Files |
production |
2026-09-18 |
| elastic |
Code Signing Policy Modification Through Built-in tools |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| elastic |
Network Connection via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Administrator Privileges Assigned to an Okta Group |
production |
2026-09-18 |
| elastic |
AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure |
production |
2026-09-18 |
| elastic |
Enumerating Domain Trusts via NLTEST.EXE |
production |
2026-09-18 |
| elastic |
Successful Application SSO from Rare Unknown Client Device |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
GitHub Secret Scanning Disabled |
production |
2026-09-18 |
| elastic |
rc.local/rc.common File Creation |
production |
2026-09-18 |
| elastic |
Shell Configuration Creation |
production |
2026-09-18 |
| elastic |
Potential Port Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Potential Execution of rc.local Script |
production |
2026-09-18 |
| elastic |
Shadow File Modification by Unusual Process |
production |
2026-09-18 |
| elastic |
Command Execution via SolarWinds Process |
production |
2026-09-18 |