| elastic |
Potential Sudo Hijacking |
production |
2026-09-18 |
| elastic |
Potential Sudo Token Manipulation via Process Injection |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Python cap_setuid |
production |
2026-09-18 |
| elastic |
Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities |
production |
2026-09-18 |
| elastic |
Suspicious Passwd File Event Action |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution (Auditd Sequence) |
production |
2026-09-18 |
| elastic |
Privilege Escalation via CAP_SETUID/SETGID Capabilities |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
UID Elevation from Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Namespace Manipulation Using Unshare |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via unshare Followed by Root Process |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation through Writable Docker Socket |
production |
2026-09-18 |
| elastic |
Discovery Command Output Written to Suspicious File |
production |
2026-09-18 |
| elastic |
Pbpaste Execution via Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Sensitive File Access followed by Compression |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Suspicious Outbound Network Connection via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Keychain CommandLine Interaction via Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Dumping Account Hashes via Built-In Commands |
production |
2026-09-18 |
| elastic |
Dumping of Keychain Content via Security Command |
production |
2026-09-18 |
| elastic |
Suspicious pbpaste High Volume Activity |
production |
2026-09-18 |
| elastic |
Kerberos Cached Credentials Dumping |
production |
2026-09-18 |
| elastic |
Persistence via Docker Shortcut Modification |
production |
2026-09-18 |
| elastic |
Emond Rules Creation or Modification |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Attempt to Enable the Root Account |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
Finder Sync Plugin Registered and Enabled |
production |
2026-09-18 |
| elastic |
Persistence via Folder Action Script |
production |
2026-09-18 |