| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual IP Address |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
Telnet Authentication Bypass via User Environment Variable |
production |
2026-09-18 |
| elastic |
Potential Telnet Authentication Bypass (CVE-2026-24061) |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Kubelet API Connection Attempt to Internal IP |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Potential THC Tool Downloaded |
production |
2026-09-18 |
| elastic |
Connection to External Network via Telnet |
production |
2026-09-18 |
| elastic |
Connection to Internal Network via Telnet |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
APT Package Manager Configuration File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
At Job Created or Modified |
production |
2026-09-18 |
| elastic |
Binfmt Configuration File Creation |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
Suspicious Usage of bpf_probe_write_user Helper |
production |
2026-09-18 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
Chkconfig Service Add |
production |
2026-09-18 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-09-18 |
| elastic |
Cron Job Created or Modified |
production |
2026-09-18 |
| elastic |
D-Bus Service Created |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
DNF Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
Dracut Module Creation |
production |
2026-09-18 |
| elastic |
Dynamic Linker Copy |
production |
2026-09-18 |
| elastic |
Initramfs Extraction via CPIO |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
GRUB Configuration File Creation |
production |
2026-09-18 |
| elastic |
GRUB Configuration Generation through Built-in Utilities |
production |
2026-09-18 |
| elastic |
System V Init Script Created |
production |
2026-09-18 |