| elastic |
Unsigned DLL Side-Loading from a Suspicious Folder |
production |
2026-09-18 |
| elastic |
Untrusted Driver Loaded |
production |
2026-09-18 |
| elastic |
Unusual File Creation - Alternate Data Stream |
production |
2026-09-18 |
| elastic |
Unusual Process Execution Path - Alternate Data Stream |
production |
2026-09-18 |
| elastic |
Unusual Network Connection via DllHost |
production |
2026-09-18 |
| elastic |
Unusual Network Connection via RunDLL32 |
production |
2026-09-18 |
| elastic |
Unusual Process Network Connection |
production |
2026-09-18 |
| elastic |
Unusual Child Process from a System Virtual Process |
production |
2026-09-18 |
| elastic |
Potential Evasion via Filter Manager |
production |
2026-09-18 |
| elastic |
WDAC Policy File by an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Evasion via Windows Filtering Platform |
production |
2026-09-18 |
| elastic |
Signed Proxy Execution via MS Work Folders |
production |
2026-09-18 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Windows Subsystem for Linux Enabled via Dism Utility |
production |
2026-09-18 |
| elastic |
Host File System Changes via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Attempt to Install or Run Kali Linux via WSL |
production |
2026-09-18 |
| elastic |
Windows Subsystem for Linux Distribution Installed |
production |
2026-09-18 |
| elastic |
Potential Enumeration via Active Directory Web Service |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
AdFind Command Activity |
production |
2026-09-18 |
| elastic |
Enumeration of Administrator Accounts |
production |
2026-09-18 |
| elastic |
Account Discovery Command via SYSTEM Account |
production |
2026-09-18 |
| elastic |
Enumerating Domain Trusts via DSQUERY.EXE |
production |
2026-09-18 |
| elastic |
Enumerating Domain Trusts via NLTEST.EXE |
production |
2026-09-18 |
| elastic |
Group Policy Discovery via Microsoft GPResult Utility |
production |
2026-09-18 |
| elastic |
Suspicious Access to LDAP Attributes |
production |
2026-09-18 |
| elastic |
System Public IP Discovery via DNS Query |
production |
2026-09-18 |
| elastic |
Peripheral Device Discovery |
production |
2026-09-18 |
| elastic |
PowerShell Share Enumeration Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Enumeration of Privileged Local Groups Membership |
production |
2026-09-18 |
| elastic |
Unusual Discovery Signal Alert with Unusual Process Executable |
production |
2026-09-18 |
| elastic |
Whoami Process Activity |
production |
2026-09-18 |
| elastic |
Command Execution via SolarWinds Process |
production |
2026-09-18 |
| elastic |
Suspicious SolarWinds Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Child Process via Azure VM CustomScript Extension |
production |
2026-09-18 |
| elastic |
Execution of COM object via Xwizard |
production |
2026-09-18 |
| elastic |
Suspicious Command Prompt Network Connection |
production |
2026-09-18 |
| elastic |
Svchost spawning Cmd |
production |
2026-09-18 |