| elastic |
Attempt to Delete an Okta Network Zone |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a Parent Process |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a User |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score |
production |
2026-09-18 |
| elastic |
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score |
production |
2026-09-18 |
| elastic |
Host Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
Parent Process Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
User Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
Linux Clipboard Activity Detected |
production |
2026-09-18 |
| elastic |
Linux Audio Recording Activity Detected |
production |
2026-09-18 |
| elastic |
Linux Video Recording or Screenshot Activity Detected |
production |
2026-09-18 |
| elastic |
Curl or Wget Execution from Container Context |
production |
2026-09-18 |
| elastic |
AWS CLI Command with Custom Endpoint URL |
production |
2026-09-18 |
| elastic |
Network Activity Detected via cat |
production |
2026-09-18 |
| elastic |
Network Connection by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Curl SOCKS Proxy Activity from Unusual Parent |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Shell Execution via Elastic Endpoint |
production |
2026-09-18 |
| elastic |
High Number of Egress Network Connections from Unusual Executable |
production |
2026-09-18 |
| elastic |
Git Repository or File Download to Suspicious Directory |
production |
2026-09-18 |
| elastic |
IPv4/IPv6 Forwarding Activity |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via Chisel Client |
production |
2026-09-18 |
| elastic |
Network Activity Detected via Kworker |
production |
2026-09-18 |
| elastic |
ProxyChains Activity |
production |
2026-09-18 |
| elastic |
Linux SSH X11 Forwarding |
production |
2026-09-18 |
| elastic |
Suspicious Utility Launched via ProxyChains |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via SSH Option |
production |
2026-09-18 |
| elastic |
Network Connection Followed by File Creation |
production |
2026-09-18 |
| elastic |
Potential Linux Tunneling and/or Port Forwarding via Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Network Activity to the Internet by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Linux Telegram API Request |
production |
2026-09-18 |
| elastic |
Potential Protocol Tunneling via EarthWorm |
production |
2026-09-18 |
| elastic |
Sensitive Identity File Open by Suspicious Process via Auditd |
production |
2026-09-18 |
| elastic |
AWS Credentials Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression |
production |
2026-09-18 |
| elastic |
Sensitive Files Compression Inside A Container |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Unshadow |
production |
2026-09-18 |
| elastic |
Linux init (PID 1) Secret Dump via GDB |
production |
2026-09-18 |