| splunk |
Linux SSH Authorized Keys Modification |
production |
2026-10-02 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Potential Redis CONFIG SET SSH Authorized Key Injection |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Activity |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| splunk |
Linux Possible Ssh Key File Creation |
production |
2026-05-13 |
| splunk |
Linux Auditd Possible Access Or Modification Of Sshd Config File |
production |
2026-05-13 |
| splunk |
Linux Possible Access Or Modification Of sshd Config File |
production |
2026-05-13 |