| elastic |
Suspicious Hidden Child Process of Launchd |
production |
2026-09-18 |
| elastic |
Persistence via DirectoryService Plugin Modification |
production |
2026-09-18 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic To a Country |
production |
2026-09-18 |
| elastic |
Unusual Windows Network Activity |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Linux Population |
production |
2026-09-18 |
| elastic |
Unusual Process For a Linux Host |
production |
2026-09-18 |
| elastic |
Unusual Process For a Windows Host |
production |
2026-09-18 |
| elastic |
Unusual Windows Path Activity |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Windows Population |
production |
2026-09-18 |
| elastic |
Anomalous Windows Process Creation |
production |
2026-09-18 |
| elastic |
Unusual Windows Service |
production |
2026-09-18 |
| elastic |
Unusual Sudo Activity |
production |
2026-09-18 |
| elastic |
Unusual Windows User Privilege Elevation Activity |
production |
2026-09-18 |
| elastic |
Anomalous Linux Compiler Activity |
production |
2026-09-18 |
| elastic |
FortiGate Configuration File Downloaded |
production |
2026-09-18 |
| elastic |
First Time Seen NFS AUTH_SYS Root UID Access |
production |
2026-09-18 |
| elastic |
Cobalt Strike Command and Control Beacon |
production |
2026-09-18 |
| elastic |
Default Cobalt Strike Team Server Certificate |
production |
2026-09-18 |
| elastic |
Roshal Archive (RAR) or PowerShell File Downloaded from the Internet |
production |
2026-09-18 |
| elastic |
Possible FIN7 DGA Command and Control Behavior |
production |
2026-09-18 |
| elastic |
Halfbaked Command and Control Beacon |
production |
2026-09-18 |
| elastic |
Potential ICMP Tunneling Activity to the Internet |
production |
2026-09-18 |
| elastic |
RDP (Remote Desktop Protocol) from the Internet |
production |
2026-09-18 |
| elastic |
SMTP to the Internet on Port 26/TCP |
production |
2026-09-18 |
| elastic |
Potential Self-Signed TLS Certificate Recently Issued on External Connection |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) from the Internet |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) to the Internet |
production |
2026-09-18 |
| elastic |
Azure WireServer HTTP Request from Unexpected User Agent |
production |
2026-09-18 |
| elastic |
Cloud Instance Metadata Credential Path HTTP Request |
production |
2026-09-18 |
| elastic |
Multiple DHCP Servers Responding to the Same Transaction |
production |
2026-09-18 |
| elastic |
ICMP Redirect Message from Internal Host |
production |
2026-09-18 |
| elastic |
Potential SIP REGISTER Brute Force |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Deprecated TLS Version or Weak Cipher Negotiated Externally |
production |
2026-09-18 |
| elastic |
FortiGate Overly Permissive Firewall Policy Created |
production |
2026-09-18 |
| elastic |
ICMP Timestamp or Information Request from the Internet |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
Potential Network Scan Detected |
production |
2026-09-18 |