| elastic |
Potential Reverse Shell via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Child |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Background Process |
production |
2026-09-18 |
| elastic |
Openssl Client or Server Activity |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Potential Code Execution via Postgresql |
production |
2026-09-18 |
| elastic |
Web Server Spawned via Python |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Python |
production |
2026-09-18 |
| elastic |
Binary Executed from Shared Memory Directory |
production |
2026-09-18 |
| elastic |
Process Started from Process ID (PID) File |
production |
2026-09-18 |
| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Perl |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
File Downloaded by Curl/Wget and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Network Connection via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
Netcat Listener Established via rlwrap |
production |
2026-09-18 |
| elastic |
Kubectl Apply Pod from URL |
production |
2026-09-18 |
| elastic |
Potential Upgrade of Non-interactive Shell |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Potential Credential Discovery via Recursive Grep |
production |
2026-09-18 |
| elastic |
Cupsd or Foomatic-rip Shell Execution |
production |
2026-09-18 |
| elastic |
Printer User (lp) Shell Execution |
production |
2026-09-18 |
| elastic |
File Creation by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Container Runtime CLI Execution with Suspicious Arguments |
production |
2026-09-18 |
| elastic |
Multi-Cloud CLI Token and Credential Access Commands |
production |
2026-09-18 |
| elastic |
Container Management Utility Run Inside A Container |
production |
2026-09-18 |
| elastic |
Suspicious Command Execution via Busybox Proxy |
production |
2026-09-18 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Yum/DNF Plugin Status Discovery |
production |
2026-09-18 |
| elastic |
Unusual User Privilege Enumeration via id |
production |
2026-09-18 |
| elastic |
Unusual Process Connection to Docker or Containerd Socket |
production |
2026-09-18 |