| elastic |
Potential HTTP Downgrade Attack |
production |
2026-09-18 |
| elastic |
AWS Security Hub Disabled |
production |
2026-09-18 |
| elastic |
Command Execution via ForFiles |
production |
2026-09-18 |
| elastic |
Threat Intel Email Indicator Match |
production |
2026-09-18 |
| elastic |
ESXI Timestomping using Touch Command |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
MySQL User-Defined Function Injection |
production |
2026-09-18 |
| elastic |
AWS VPC Flow Logs Deletion |
production |
2026-09-18 |
| elastic |
M365 Exchange Federated Domain Created or Modified |
production |
2026-09-18 |
| elastic |
Processes with Trailing Spaces |
production |
2026-09-18 |
| elastic |
Virtual Private Network Connection Attempt |
production |
2026-09-18 |
| elastic |
M365 SharePoint Site Administrator Added |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
AWS EC2 Role GetCallerIdentity from New Source AS Organization |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Full Disk Access Permission Check |
production |
2026-09-18 |
| elastic |
GRUB Configuration Generation through Built-in Utilities |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Policy Updated to Allow Public Invocation |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
Entra ID OAuth Device Code Grant by Unusual User |
production |
2026-09-18 |
| elastic |
Suspicious Apple Mail Rule Plist Modification |
production |
2026-09-18 |
| elastic |
rc.local/rc.common File Creation |
production |
2026-09-18 |
| elastic |
AWS Attempt to Leave Organization |
production |
2026-09-18 |
| elastic |
Microsoft Graph Multi-Category Reconnaissance Burst |
production |
2026-09-18 |
| elastic |
Kubernetes Static Pod Manifest File Access |
production |
2026-09-18 |
| elastic |
GCP Service Account Key Creation |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
AWS Route 53 Domain Transfer Lock Disabled |
production |
2026-09-18 |
| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
System File Ownership Change |
production |
2026-09-18 |
| elastic |
AWS IAM User Created Access Keys For Another User |
production |
2026-09-18 |
| elastic |
Exchange Mailbox Export via PowerShell |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation |
production |
2026-09-18 |
| elastic |
Enumeration of Users or Groups via Built-in Commands |
production |
2026-09-18 |
| elastic |
Dynamic Linker Copy |
production |
2026-09-18 |
| elastic |
GKE Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox High-Risk Permission Delegated |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |