| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Potential SQL Injection Against Microsoft SQL Server |
production |
2026-09-18 |
| elastic |
Suspicious Child Process of PaperCut Server Component |
production |
2026-09-18 |
| elastic |
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process |
production |
2026-09-18 |
| elastic |
Remote Desktop File Opened from Suspicious Path |
production |
2026-09-18 |
| elastic |
Windows Script Executing PowerShell |
production |
2026-09-18 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Writing Suspicious Files |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Server UM Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Worker Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| elastic |
Windows Server Update Service Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-33053 Exploitation |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
ScreenConnect Server Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Potential Pass-the-Hash (PtH) Attempt |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Suspicious Kerberos Authentication Ticket Request |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with MMC |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows |
production |
2026-09-18 |
| elastic |
NullSessionPipe Registry Modification |
production |
2026-09-18 |
| elastic |
SMB Connections via LOLBin or Untrusted Process |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Shadowing Activity |
production |
2026-09-18 |
| elastic |
Potential Lateral Tool Transfer via SMB Share |
production |
2026-09-18 |
| elastic |
Execution via TSClient Mountpoint |
production |
2026-09-18 |
| elastic |
Remote Execution via File Shares |
production |
2026-09-18 |
| elastic |
Incoming Execution via WinRM Remote Shell |
production |
2026-09-18 |
| elastic |
WMI Incoming Lateral Movement |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
Incoming Execution via PowerShell Remoting |
production |
2026-09-18 |
| elastic |
RDP Enabled via Registry |
production |
2026-09-18 |
| elastic |
Potential SharpRDP Behavior |
production |
2026-09-18 |
| elastic |
Remote File Copy to a Hidden Share |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation via RPC |
production |
2026-09-18 |