| elastic |
Systemd Service Override Configuration File Created |
production |
2026-10-21 |
| elastic |
Namespace Manipulation Using Unshare |
production |
2026-10-09 |
| elastic |
GRUB Configuration Generation through Built-in Utilities |
production |
2026-10-09 |
| elastic |
Pluggable Authentication Module (PAM) Version Discovery |
production |
2026-10-09 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-10-08 |
| elastic |
Unusual Pkexec Execution |
production |
2026-10-08 |
| elastic |
Launch Item Registration with Suspicious Executable Path via macOS Security Events |
production |
2026-10-06 |
| elastic |
Persistence via a Hidden Plist Filename via macOS Security Events |
production |
2026-10-06 |
| elastic |
Suspicious Service was Installed in the System |
production |
2026-10-06 |
| elastic |
First Time Python Created a LaunchAgent or LaunchDaemon |
production |
2026-09-29 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Potential Privilege Escalation via Service ImagePath Modification |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Linux Population |
production |
2026-09-18 |
| elastic |
Unusual Process For a Linux Host |
production |
2026-09-18 |
| elastic |
Unusual Process For a Windows Host |
production |
2026-09-18 |
| elastic |
Unusual Windows Path Activity |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Windows Population |
production |
2026-09-18 |
| elastic |
Anomalous Windows Process Creation |
production |
2026-09-18 |
| elastic |
Unusual Windows Service |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Network Logon Provider Registry Modification |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Service Command Lateral Movement |
production |
2026-09-18 |
| elastic |
Remote Windows Service Installed |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
Unusual Persistence via Services Registry |
production |
2026-09-18 |
| elastic |
Suspicious ImagePath Service Creation |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| elastic |
Persistence via Update Orchestrator Service Hijack |
production |
2026-09-18 |
| elastic |
Persistence via WMI Standard Registry Provider |
production |
2026-09-18 |
| elastic |
First Time Seen Driver Loaded |
production |
2026-09-18 |
| elastic |
Creation or Modification of a new GPO Scheduled Task or Service |
production |
2026-09-18 |
| elastic |
Service Creation via Local Kerberos Authentication |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Windows Service Installed via an Unusual Client |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Namespace Manipulation Using Unshare in a Container |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Suspicious Mining Process Creation Event |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
APT Package Manager Configuration File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
Chkconfig Service Add |
production |
2026-09-18 |
| elastic |
D-Bus Service Created |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
DNF Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
Dracut Module Creation |
production |
2026-09-18 |
| elastic |
Initramfs Extraction via CPIO |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
GRUB Configuration File Creation |
production |
2026-09-18 |
| elastic |
Kubernetes Sensitive Configuration File Activity |
production |
2026-09-18 |
| elastic |
Kubernetes Static Pod Manifest File Access |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module or Configuration Creation |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Creation in Unusual Directory |
production |
2026-09-18 |
| elastic |
Potential Backdoor Execution Through PAM_EXEC |
production |
2026-09-18 |
| elastic |
Pluggable Authentication Module (PAM) Source Download |
production |
2026-09-18 |
| elastic |
Polkit Policy Creation |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Systemd Service Created |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Systemd Shell Execution During Boot |
production |
2026-09-18 |
| elastic |
Initramfs Unpacking via unmkinitramfs |
production |
2026-09-18 |
| elastic |
Authentication via Unusual PAM Grantor |
production |
2026-09-18 |
| elastic |
Yum Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
Launch Service Creation and Immediate Loading |
production |
2026-09-18 |
| elastic |
Suspicious Hidden Child Process of Launchd |
production |
2026-09-18 |
| elastic |
Persistence via Docker Shortcut Modification |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
Finder Sync Plugin Registered and Enabled |
production |
2026-09-18 |
| elastic |
Persistence via a Hidden Plist Filename |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Persistence via Suspicious Launch Agent or Launch Daemon |
production |
2026-09-18 |
| splunk |
Windows Process Execution in Temp Dir |
production |
2026-09-01 |
| splunk |
Windows Suspicious Process File Path |
production |
2026-09-01 |
| splunk |
Wscript Or Cscript Suspicious Child Process |
production |
2026-07-20 |
| splunk |
LLM Model File Creation |
production |
2026-07-15 |
| splunk |
Windows Local LLM Framework Execution |
production |
2026-07-15 |
| splunk |
MacOS Kextload Usage |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Nsenter Usage in Kubernetes Pod |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Shell Execution |
production |
2026-05-13 |
| splunk |
Clop Ransomware Known Service Name |
production |
2026-05-13 |
| splunk |
Cisco Isovalent - Late Process Execution |
production |
2026-05-13 |
| elastic |
Deprecated - LaunchDaemon Creation or Modification and Immediate Loading |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Modification of Standard Authentication Module or Configuration |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
PUA - System Informer Driver Load |
test |
2024-11-23 |
| sigma |
PUA - Process Hacker Execution |
test |
2024-11-23 |
| sigma |
PUA - System Informer Execution |
test |
2024-11-23 |
| sigma |
PUA - Process Hacker Driver Load |
test |
2024-11-23 |
| sigma |
CodeIntegrity - Blocked Image/Driver Load For Policy Violation |
test |
2023-06-07 |
| sigma |
CodeIntegrity - Blocked Driver Load With Revoked Certificate |
test |
2023-06-06 |
| sigma |
Service Installed By Unusual Client - Security |
test |
2023-01-04 |
| sigma |
Service Installed By Unusual Client - System |
test |
2023-01-04 |
| sigma |
KrbRelayUp Service Installation |
test |
2022-10-05 |
| sentinel |
COM Event System Loading New DLL |
Scheduled |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes (Normalized Process Events) |
Scheduled |
— |