| elastic |
Potential Command Shell via NetCat |
production |
2026-09-18 |
| elastic |
Outbound Scheduled Task Activity via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation |
production |
2026-09-18 |
| elastic |
Suspicious RDP ActiveX Client Loaded |
production |
2026-09-18 |
| elastic |
Unusual Child Process of dns.exe |
production |
2026-09-18 |
| elastic |
Unusual File Operation by dns.exe |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
Potential WSUS Abuse for Lateral Movement |
production |
2026-09-18 |
| elastic |
AdminSDHolder Backdoor |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: sqlmap User Agent |
production |
2026-09-18 |
| elastic |
Suspicious File Downloaded from Google Drive |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
PANW and Elastic Defend - Command and Control Correlation |
production |
2026-09-18 |
| elastic |
Potential Cookies Theft via Browser Debugging |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| elastic |
Suricata and Elastic Defend Network Correlation |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
FortiGate SOCKS Traffic from an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: Unauthorized Method |
production |
2026-09-18 |
| elastic |
GitHub Repository Deleted |
production |
2026-09-18 |
| elastic |
High Number of Closed Pull Requests by User |
production |
2026-09-18 |
| elastic |
Several Failed Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
High Number of Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
GitHub Actions Unusual Bot Push to Repository |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
New GitHub Self Hosted Action Runner |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
GitHub Owner Role Granted To User |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Data Transfer or Takeout Export Initiated |
production |
2026-09-18 |
| elastic |
Google Workspace Gmail Routing or Forwarding Rule Created or Modified |
production |
2026-09-18 |