| elastic |
Memory Swap Modification |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Potential Linux Ransomware Note Creation Detected |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual IP Address |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
Telnet Authentication Bypass via User Environment Variable |
production |
2026-09-18 |
| elastic |
Potential Telnet Authentication Bypass (CVE-2026-24061) |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
dMSA Account Creation by an Unusual User |
production |
2026-09-18 |
| elastic |
Disabling User Account Control via Registry Modification |
production |
2026-09-18 |
| elastic |
Modification of the msPKIAccountCredentials |
production |
2026-09-18 |
| elastic |
Process Created with a Duplicated Token |
production |
2026-09-18 |
| elastic |
Process Creation via Secondary Logon |
production |
2026-09-18 |
| elastic |
Delegated Managed Service Account Modification by an Unusual User |
production |
2026-09-18 |
| elastic |
Potential Account Takeover - Mixed Logon Types |
production |
2026-09-18 |
| elastic |
Kubeconfig File Creation or Modification |
production |
2026-09-18 |
| elastic |
Kubelet API Connection Attempt to Internal IP |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Potential THC Tool Downloaded |
production |
2026-09-18 |
| elastic |
Connection to External Network via Telnet |
production |
2026-09-18 |
| elastic |
Connection to Internal Network via Telnet |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
APT Package Manager Configuration File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
At Job Created or Modified |
production |
2026-09-18 |
| elastic |
Binfmt Configuration File Creation |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
Suspicious Usage of bpf_probe_write_user Helper |
production |
2026-09-18 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
Chkconfig Service Add |
production |
2026-09-18 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-09-18 |
| elastic |
Cron Job Created or Modified |
production |
2026-09-18 |
| elastic |
D-Bus Service Created |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
DNF Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |