| elastic |
Package Runtime Secret File Access Followed by IMDS Request |
production |
2026-10-23 |
| elastic |
Command Execution via SolarWinds Process |
production |
2026-10-06 |
| elastic |
Suspicious SolarWinds Child Process |
production |
2026-10-06 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-10-06 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Elastic Defend Alert from GenAI Utility or Descendant |
production |
2026-09-25 |
| elastic |
Curl Download Activity from npm Package Install |
production |
2026-09-23 |
| elastic |
Network Connection to OAST Domain via Script Interpreter |
production |
2026-09-23 |
| elastic |
Suspicious PowerShell from npm Package Install |
production |
2026-09-22 |
| elastic |
New GitHub Self Hosted Action Runner |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Remote GitHub Actions Runner Registration |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert from Package Manager Install Ancestry |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
GitHub Actions Unusual Bot Push to Repository |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners |
production |
2026-09-18 |
| elastic |
Deprecated - SUNBURST Command and Control Activity |
deprecated |
2026-08-19 |
| splunk |
GitHub Organizations Disable Dependabot |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Dependabot |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable IP Allow List |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Modify Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Pause Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Register Self Hosted Runner |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Remove Organization |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Deleted |
production |
2026-05-13 |
| splunk |
GitHub Organizations Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Deleted |
production |
2026-05-13 |
| splunk |
GitHub Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| sigma |
Octopus Scanner Malware |
test |
2021-11-27 |
| sentinel |
Solorigate Defender Detections |
Scheduled |
— |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) |
Scheduled |
— |