| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
Proxy Shell Execution via Busybox |
production |
2026-09-18 |
| elastic |
File made Immutable by Chattr |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |
| elastic |
Hidden Files and Directories via Hidden Flag |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Potential Disabling of AppArmor |
production |
2026-09-18 |
| elastic |
Potential Disabling of SELinux |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via Doas |
production |
2026-09-18 |
| elastic |
Dynamic Linker Creation |
production |
2026-09-18 |
| elastic |
ESXI Timestomping using Touch Command |
production |
2026-09-18 |
| elastic |
Process Execution Followed by Self-Deletion |
production |
2026-09-18 |
| elastic |
File Creation in World-Writable Directory by Unusual Process |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
File Permission Modification in Writable Directory |
production |
2026-09-18 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-09-18 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-09-18 |
| elastic |
Hidden Directory Creation via Unusual Parent |
production |
2026-09-18 |
| elastic |
Creation of Hidden Files and Directories via CommandLine |
production |
2026-09-18 |
| elastic |
Creation of Hidden Shared Object File |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Kernel Module Removal |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
System Log File Deletion |
production |
2026-09-18 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-09-18 |