| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-10-06 |
| splunk |
Linux Auditd Possible Access To Credential Files |
production |
2026-10-02 |
| elastic |
Potential Linux Credential Dumping via Unshadow |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Linux DAC permissions |
production |
2026-09-18 |
| elastic |
Suspicious Symbolic Link Created |
production |
2026-09-18 |
| elastic |
Potential Shadow File Read via Command Line Utilities |
production |
2026-09-18 |
| elastic |
Dumping Account Hashes via Built-In Commands |
production |
2026-09-18 |
| elastic |
Potential Unauthorized Access via Wildcard Injection Detected |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| splunk |
ESXi Sensitive Files Accessed |
production |
2026-05-13 |
| splunk |
Linux Possible Access To Credential Files |
production |
2026-05-13 |