| elastic |
Suspicious JavaScript Execution via Deno |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Suspicious /proc/maps Discovery |
production |
2026-09-18 |
| elastic |
Potential SharpRDP Behavior |
production |
2026-09-18 |
| elastic |
Potential Subnet Scanning Activity from Compromised Host |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
InstallUtil Process Making Network Connections |
production |
2026-09-18 |
| elastic |
AWS CloudShell Environment Created |
production |
2026-09-18 |
| elastic |
Container Management Utility Run Inside A Container |
production |
2026-09-18 |
| elastic |
Suspicious rc.local Error Message |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Writing Suspicious Files |
production |
2026-09-18 |
| elastic |
Entra ID Kali365 Default User-Agent Detected |
production |
2026-09-18 |
| elastic |
High Number of Okta User Password Reset or Unlock Attempts |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| elastic |
Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Character Array Reconstruction |
production |
2026-09-18 |
| elastic |
Malware - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Shadowing Activity |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| elastic |
Ransomware - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Execution via TSClient Mountpoint |
production |
2026-09-18 |
| elastic |
Suspicious Kerberos Authentication Ticket Request |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
SUID/SGUID Enumeration Detected |
production |
2026-09-18 |
| elastic |
Exploit - Prevented - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Exploit - Detected - Elastic Endgame |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in TeamFiltration User-Agent Detected |
production |
2026-09-18 |
| elastic |
WMI Incoming Lateral Movement |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Pods Deleted |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
Suspicious HTML File Creation |
production |
2026-09-18 |
| elastic |
Windows Script Executing PowerShell |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Suspicious PowerShell Engine ImageLoad |
production |
2026-09-18 |
| elastic |
Kubernetes Forbidden Request from Unusual User Agent |
production |
2026-09-18 |