| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Suspicious Outbound Network Connection via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Keychain CommandLine Interaction via Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Dumping Account Hashes via Built-In Commands |
production |
2026-09-18 |
| elastic |
Dumping of Keychain Content via Security Command |
production |
2026-09-18 |
| elastic |
Suspicious pbpaste High Volume Activity |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Keychain Password Retrieval via Command Line |
production |
2026-09-18 |
| elastic |
WebProxy Settings Modification |
production |
2026-09-18 |
| elastic |
Potential macOS SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Prompt for Credentials with Osascript |
production |
2026-09-18 |
| elastic |
Suspicious Web Browser Sensitive File Access |
production |
2026-09-18 |
| elastic |
SystemKey Access via Command Line |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |
| elastic |
Quarantine Attrib Removed by Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Attempt to Disable Gatekeeper |
production |
2026-09-18 |
| elastic |
Dylib Injection via Process Environment Variables |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Attempt to Install Root Certificate |
production |
2026-09-18 |
| elastic |
Modification of Environment Variable via Unsigned or Untrusted Parent |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via TCCDB Modification |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via Localhost Secure Copy |
production |
2026-09-18 |
| elastic |
Modification of Safari Settings via Defaults Command |
production |
2026-09-18 |
| elastic |
Potential Microsoft Office Sandbox Evasion |
production |
2026-09-18 |
| elastic |
Suspicious TCC Access Granted for User Folders |
production |
2026-09-18 |
| elastic |
TCC Bypass via Mounted APFS Snapshot Access |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
DNS Request for IP Lookup Service via Unsigned Binary |
production |
2026-09-18 |
| elastic |
External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
Full Disk Access Permission Check |
production |
2026-09-18 |
| elastic |
Suspicious SIP Check by macOS Application |
production |
2026-09-18 |