| elastic |
Command Execution via ForFiles |
production |
2026-09-18 |
| elastic |
Proxy Execution via Windows OpenSSH |
production |
2026-09-18 |
| elastic |
Process Injection by the Microsoft Build Engine |
production |
2026-09-18 |
| elastic |
InstallUtil Process Making Network Connections |
production |
2026-09-18 |
| elastic |
Execution via Windows Command Debugging Utility |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
Suspicious Endpoint Security Parent Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Svchost |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Renamed Automation Script Interpreter |
production |
2026-09-18 |
| elastic |
Suspicious WerFault Child Process |
production |
2026-09-18 |
| elastic |
Program Files Directory Masquerading |
production |
2026-09-18 |
| elastic |
Potential Windows Error Manager Masquerading |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Microsoft Windows Defender Tampering |
production |
2026-09-18 |
| elastic |
Network Connection via Signed Binary |
production |
2026-09-18 |
| elastic |
System File Ownership Change |
production |
2026-09-18 |
| elastic |
MS Office Macro Security Registry Modifications |
production |
2026-09-18 |
| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
Mshta Making Network Connections |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-09-18 |
| elastic |
MsiExec Service Child Process With Network Connection |
production |
2026-09-18 |
| elastic |
Potential Remote Install via MsiExec |
production |
2026-09-18 |
| elastic |
Network Connection via MsXsl |
production |
2026-09-18 |
| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-09-18 |
| elastic |
Potential NetNTLMv1 Downgrade Attack |
production |
2026-09-18 |
| elastic |
Command Obfuscation via Unicode Modifier Letters |
production |
2026-09-18 |
| elastic |
Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Payload Encoded and Compressed |
production |
2026-09-18 |
| elastic |
PowerShell Script with Windows Defender Tampering Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Script with Encryption/Decryption Capabilities |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscated Script via High Entropy |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Invalid Escape Sequences |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Character Array Reconstruction |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |