| elastic |
Suspicious Command Execution from Visual Studio Code |
production |
2026-10-26 |
| elastic |
Potential NetScaler Log Poisoning Command Injection Attempt |
production |
2026-10-23 |
| elastic |
AWS SSM Session Manager Child Process Execution |
production |
2026-10-21 |
| sigma |
Shell Spawned by Celery Worker Process |
experimental |
2026-10-17 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-10-09 |
| elastic |
Suspicious React Server Child Process |
production |
2026-10-09 |
| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| elastic |
Memory Swap Modification |
production |
2026-10-09 |
| elastic |
Suspicious Content Extracted or Decompressed via Funzip |
production |
2026-10-09 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-10-09 |
| elastic |
Exec Into Container Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-10-08 |
| elastic |
Network Connections Initiated Through XDG Autostart Entry |
production |
2026-10-08 |
| elastic |
Unusual Pkexec Execution |
production |
2026-10-08 |
| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-10-08 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-10-06 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
Potential Reverse Shell via Java |
production |
2026-10-05 |
| elastic |
Curl Execution via Shell Profile |
production |
2026-10-05 |
| splunk |
Linux Decode Base64 to Shell |
production |
2026-10-02 |
| splunk |
Linux Magic SysRq Key Abuse |
production |
2026-10-02 |
| elastic |
Zimbra Swatchdog SNMP Command Injection Execution |
production |
2026-09-30 |
| elastic |
ESXi Payload Executed Against Datastore |
production |
2026-09-30 |
| elastic |
ESXi Shell Command Obfuscation |
production |
2026-09-30 |
| elastic |
First Time Python Spawned a Shell on Host |
production |
2026-09-29 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
Curl Download Activity from npm Package Install |
production |
2026-09-23 |
| elastic |
Interactive Shell Launched via Unusual Parent Process in a Container |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via UDP |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Suspicious Mining Process Creation Event |
production |
2026-09-18 |
| elastic |
Suspicious Named Pipe Creation |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
File Transfer Utility Launched from Unusual Parent |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
Dracut Module Creation |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
Manual Dracut Execution |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Systemd Shell Execution During Boot |
production |
2026-09-18 |
| elastic |
Initramfs Unpacking via unmkinitramfs |
production |
2026-09-18 |
| elastic |
Unusual Child Execution via Web Server |
production |
2026-09-18 |
| elastic |
Unusual Command Execution via Web Server |
production |
2026-09-18 |
| elastic |
Root Network Connection via GDB CAP_SYS_PTRACE |
production |
2026-09-18 |
| elastic |
Potential Shell via Wildcard Injection Detected |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Shell Execution via Apple Scripting |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Pkg Install Script |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| elastic |
Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Host File System Changes via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Attempt to Install or Run Kali Linux via WSL |
production |
2026-09-18 |
| elastic |
Windows Subsystem for Linux Distribution Installed |
production |
2026-09-18 |
| splunk |
MacOS Osascript Executing Interactive Shell |
production |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` with Run Shell Command Parameters |
production |
2026-09-18 |
| elastic |
Azure Run Command Script Child Process |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Common Utilities |
production |
2026-09-18 |
| elastic |
Forbidden Direct Interactive Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Potential Git CVE-2025-48384 Exploitation |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
Privileged Container Creation with Host Directory Mount |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Potential Java Service Exploitation via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution by Zoom |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Potential SQL Injection Request |
production |
2026-09-18 |
| elastic |
AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content |
production |
2026-09-18 |
| elastic |
File Download Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Interactive Shell Spawn Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Netcat File Transfer or Listener Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Payload Execution via Shell Pipe Detected by Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Network Connection by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Shell Execution via Elastic Endpoint |
production |
2026-09-18 |
| elastic |
Network Connection Followed by File Creation |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Proxy Shell Execution via Busybox |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Suspicious Command Execution via Busybox Proxy |
production |
2026-09-18 |
| elastic |
File Creation by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Printer User (lp) Shell Execution |
production |
2026-09-18 |
| elastic |
Cupsd or Foomatic-rip Shell Execution |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Potential Upgrade of Non-interactive Shell |
production |
2026-09-18 |
| elastic |
Netcat Listener Established via rlwrap |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Network Connection via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
File Downloaded by Curl/Wget and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Perl |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Python |
production |
2026-09-18 |
| elastic |
Potential Code Execution via Postgresql |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Openssl Client or Server Activity |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Background Process |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Child |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Potential Meterpreter Reverse Shell |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Suspicious Binary |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Suspicious Linux Process Connection to Bulletproof Hosting ASN |
production |
2026-09-17 |
| splunk |
Linux Suspicious Privileged Container Execution |
production |
2026-07-08 |
| splunk |
Linux MOTD Script Added |
production |
2026-07-08 |
| splunk |
Linux Netcat Outbound Connection |
production |
2026-07-08 |
| splunk |
Linux Possible System Binary Backdoor |
production |
2026-07-08 |
| splunk |
Linux Suspicious XDG Autostart |
production |
2026-07-08 |
| elastic |
Deprecated - Uncommon Destination Port Connection by Web Server |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Linux Restricted Shell Breakout via Linux Binary(s) |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Command Execution from Web Server Parent |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| splunk |
Linux Unix Shell Enable All SysRq Functions |
production |
2026-05-13 |
| splunk |
Linux Suspicious React or Next.js Child Process |
production |
2026-05-13 |
| splunk |
Suspicious Linux Discovery Commands |
production |
2026-05-13 |
| splunk |
MacOS LOLbin |
production |
2026-05-13 |
| sigma |
Axios NPM Compromise Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - macOS |
experimental |
2026-04-01 |
| sigma |
Shell Invocation via Env Command - Linux |
test |
2026-01-08 |
| sigma |
Script Interpreter Spawning Credential Scanner - Linux |
experimental |
2025-11-25 |
| sigma |
JexBoss Command Sequence |
test |
2025-11-22 |
| sigma |
Potentially Suspicious Long Filename Pattern - Linux |
experimental |
2025-11-22 |
| sigma |
Suspicious Filename with Embedded Base64 Commands |
experimental |
2025-11-22 |
| sigma |
Suspicious Download and Execute Pattern via Curl/Wget |
experimental |
2025-06-17 |
| sigma |
Potential Abuse of Linux Magic System Request Key |
experimental |
2025-05-23 |
| elastic |
Deprecated - Potential Reverse Shell via Suspicious Parent Process |
deprecated |
2023-11-02 |
| elastic |
Reverse Shell Created via Named Pipe |
deprecated |
2023-07-04 |
| sigma |
Linux Reverse Shell Indicator |
test |
2022-12-25 |
| sigma |
Suspicious Commands Linux |
test |
2022-10-05 |
| sigma |
AWS EC2 Startup Shell Script Change |
test |
2022-06-07 |
| sigma |
Nohup Execution |
test |
2022-06-06 |
| elastic |
Linux Restricted Shell Breakout via apt/apt-get Changelog Escape |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via awk Commands |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via busybox Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the expect command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via env Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via crash Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via cpulimit Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via c89/c99 Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the SSH command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the vi command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the mysql command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the gcc command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via flock Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the find command |
deprecated |
2022-05-09 |
| sigma |
Interactive Bash Suspicious Children |
test |
2022-03-14 |
| sigma |
BPFtrace Unsafe Option Usage |
test |
2022-02-11 |
| sigma |
Suspicious Activity in Shell Commands |
test |
2021-11-27 |
| sigma |
Equation Group Indicators |
test |
2021-11-27 |
| sigma |
Suspicious Reverse Shell Command Line |
test |
2021-11-27 |
| sentinel |
PHP Worker Process Spawning Shell/Recon Tool |
Scheduled |
— |