| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Perl |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
File Downloaded by Curl/Wget and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Network Connection via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Netcat Listener Established via rlwrap |
production |
2026-09-18 |
| elastic |
Kubectl Apply Pod from URL |
production |
2026-09-18 |
| elastic |
Potential Upgrade of Non-interactive Shell |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Cupsd or Foomatic-rip Shell Execution |
production |
2026-09-18 |
| elastic |
Printer User (lp) Shell Execution |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Potential Hidden Process via Mount Hidepid |
production |
2026-09-18 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-09-18 |
| elastic |
System Log File Deletion |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Kernel Module Removal |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Creation of Hidden Shared Object File |
production |
2026-09-18 |
| elastic |
Creation of Hidden Files and Directories via CommandLine |
production |
2026-09-18 |
| elastic |
Hidden Directory Creation via Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-09-18 |
| elastic |
File Permission Modification in Writable Directory |
production |
2026-09-18 |
| elastic |
File Deletion via Shred |
production |
2026-09-18 |
| elastic |
File Creation in World-Writable Directory by Unusual Process |
production |
2026-09-18 |
| elastic |
Process Execution Followed by Self-Deletion |
production |
2026-09-18 |
| elastic |
ESXI Timestomping using Touch Command |
production |
2026-09-18 |
| elastic |
Dynamic Linker Creation |
production |
2026-09-18 |