| elastic |
Potential Lateral Tool Transfer via SMB Share |
production |
2026-10-19 |
| elastic |
Connection to Internal Network via Telnet |
production |
2026-10-08 |
| elastic |
Connection to External Network via Telnet |
production |
2026-10-08 |
| splunk |
Cisco Secure Firewall - Communication Over Suspicious Ports |
production |
2026-10-08 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-10-08 |
| elastic |
Incoming Execution via PowerShell Remoting |
production |
2026-10-06 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
SMB Connections via LOLBin or Untrusted Process |
production |
2026-10-06 |
| elastic |
ESXi SSH Access Enabled |
production |
2026-09-30 |
| elastic |
ESXi SSH Session from vpxuser |
production |
2026-09-30 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
RPC (Remote Procedure Call) to the Internet |
production |
2026-09-21 |
| elastic |
Accepted Default Telnet Port Connection |
production |
2026-09-21 |
| elastic |
Suspicious RDP ActiveX Client Loaded |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Suspicious Cmd Execution via WMI |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Potential Ransomware Behavior - Note Files by System |
production |
2026-09-18 |
| elastic |
Suspicious File Renamed via SMB |
production |
2026-09-18 |
| elastic |
Potential Ransomware Note File Dropped via SMB |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement via MSHTA |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with MMC |
production |
2026-09-18 |
| elastic |
Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows |
production |
2026-09-18 |
| elastic |
NullSessionPipe Registry Modification |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Shadowing Activity |
production |
2026-09-18 |
| elastic |
Execution via TSClient Mountpoint |
production |
2026-09-18 |
| elastic |
Remote Execution via File Shares |
production |
2026-09-18 |
| elastic |
Incoming Execution via WinRM Remote Shell |
production |
2026-09-18 |
| elastic |
WMI Incoming Lateral Movement |
production |
2026-09-18 |
| elastic |
Mounting Hidden or WebDav Remote Shares |
production |
2026-09-18 |
| elastic |
RDP Enabled via Registry |
production |
2026-09-18 |
| elastic |
Potential SharpRDP Behavior |
production |
2026-09-18 |
| elastic |
Remote File Copy to a Hidden Share |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Remotely Started Services via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation via RPC |
production |
2026-09-18 |
| elastic |
Remote Scheduled Task Creation |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Activity |
production |
2026-09-18 |
| elastic |
AWS SSM Session Started to EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity |
production |
2026-09-18 |
| elastic |
Unusual AWS Command for a User |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
Azure VM Serial Console Connection with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
Unusual Azure Activity Logs Event for a User |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Unusual GCP Event for a User |
production |
2026-09-18 |
| elastic |
High Mean of Process Arguments in an RDP Session |
production |
2026-09-18 |
| elastic |
High Mean of RDP Session Duration |
production |
2026-09-18 |
| elastic |
High Variance in RDP Session Duration |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made from a Source IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Connections Made to a Destination IP |
production |
2026-09-18 |
| elastic |
Spike in Number of Processes in an RDP Session |
production |
2026-09-18 |
| elastic |
Unusual Time or Day for an RDP Session |
production |
2026-09-18 |
| elastic |
Linux SSH X11 Forwarding |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual IP Address |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Kubelet API Connection Attempt to Internal IP |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Potential THC Tool Downloaded |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
Attempt to Mount SMB Share via Command Line |
production |
2026-09-18 |
| elastic |
Remote SSH Login Enabled via systemsetup Command |
production |
2026-09-18 |
| elastic |
Virtual Private Network Connection Attempt |
production |
2026-09-18 |
| elastic |
Unusual Source IP for a User to Logon from |
production |
2026-09-18 |
| elastic |
Unusual Windows Remote User |
production |
2026-09-18 |
| elastic |
Unusual Windows Network Activity |
production |
2026-09-18 |
| elastic |
RDP (Remote Desktop Protocol) from the Internet |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) to the Internet |
production |
2026-09-18 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
Quick Assist Full Control Sharing Mode Enabled |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| elastic |
Potential Machine Account Relay Attack via SMB |
production |
2026-09-18 |
| elastic |
Windows Registry File Creation in SMB Share |
production |
2026-09-18 |
| elastic |
Protected Storage Service Access via SMB |
production |
2026-09-18 |
| elastic |
Potential Remote Credential Access via Registry |
production |
2026-09-18 |
| elastic |
Suspicious Remote Registry Access via SeBackupPrivilege |
production |
2026-09-18 |
| elastic |
Network-Level Authentication (NLA) Disabled |
production |
2026-09-18 |
| elastic |
Remote Desktop Enabled in Windows Firewall by Netsh |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
PsExec Network Connection |
production |
2026-09-18 |
| elastic |
Outbound Scheduled Task Activity via PowerShell |
production |
2026-09-18 |
| splunk |
Cisco IOS XE VTY Access Class Tampering |
production |
2026-05-20 |
| splunk |
ESXi Shell Access Enabled |
production |
2026-05-13 |
| splunk |
Enable RDP In Other Port Number |
production |
2026-05-13 |
| splunk |
Cisco Network Interface Modifications |
production |
2026-05-13 |
| sigma |
HackTool - NetExec Execution |
experimental |
2026-03-29 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container via Elastic Defend |
deprecated |
2026-02-04 |
| elastic |
Deprecated - SSH Connection Established Inside A Running Container |
deprecated |
2025-03-14 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container |
deprecated |
2025-03-14 |
| suricata |
ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement |
rev 5 |
2024-04-13 |
| sigma |
OpenCanary - SSH Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - SSH New Connection Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - SNMP OID Request |
test |
2024-03-08 |
| sigma |
OpenCanary - SMB File Open Request |
test |
2024-03-08 |
| sigma |
OpenCanary - FTP Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - VNC Connection Attempt |
test |
2024-03-08 |
| elastic |
Potential SSH Brute Force Detected on Privileged Account |
deprecated |
2023-06-22 |
| snort |
ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement |
rev 3 |
2023-04-14 |
| sigma |
Psexec Execution |
test |
2023-02-28 |
| sigma |
Privilege Escalation via Named Pipe Impersonation |
test |
2022-12-30 |
| sigma |
Potential Remote Desktop Tunneling |
test |
2022-09-27 |
| elastic |
SSH (Secure Shell) from the Internet |
deprecated |
2021-04-15 |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
RDP Nesting |
Scheduled |
— |
| sentinel |
Rare RDP Connections |
Scheduled |
— |
| sentinel |
Multiple RDP connections from Single System |
Scheduled |
— |