| suricata |
ET ADWARE_PUP Request For Third-Party Windows Activation Script |
rev 1 |
2026-10-12 |
| snort |
ET INFO Request For Third-Party Windows Activation Script |
rev 1 |
2026-10-12 |
| elastic |
Startup/Logon Script added to Group Policy Object |
production |
2026-10-06 |
| elastic |
Unusual Azure VM Extension Detected |
production |
2026-09-28 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| elastic |
Suspicious Network Activity to the Internet by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Chkconfig Service Add |
production |
2026-09-18 |
| elastic |
System V Init Script Created |
production |
2026-09-18 |
| elastic |
Message-of-the-Day (MOTD) File Creation |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Suspicious rc.local Error Message |
production |
2026-09-18 |
| elastic |
rc.local/rc.common File Creation |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Systemd-udevd Rule File Creation |
production |
2026-09-18 |
| elastic |
Unusual Exim4 Child Process |
production |
2026-09-18 |
| elastic |
Persistence via Folder Action Script |
production |
2026-09-18 |
| elastic |
Persistence via Login or Logout Hook |
production |
2026-09-18 |
| elastic |
Potential Persistence via Login Hook |
production |
2026-09-18 |
| elastic |
Suspicious StartupItem Plist Creation |
production |
2026-09-18 |
| elastic |
Potential Persistence via Atom Init Script Modification |
production |
2026-09-18 |
| elastic |
Uncommon Registry Persistence Change |
production |
2026-09-18 |
| elastic |
Potential Execution of rc.local Script |
production |
2026-09-18 |
| elastic |
Azure VM Extension CRUD Operation with Unusual Source ASN |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| splunk |
Linux UDEV Rule Created |
production |
2026-07-08 |
| splunk |
Linux Suspicious XDG Autostart |
production |
2026-07-08 |
| splunk |
Linux MOTD Script Added |
production |
2026-07-08 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |