| elastic |
Systemd Service Override Configuration File Created |
production |
2026-10-21 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Systemd Service Created |
production |
2026-09-18 |
| elastic |
Systemd Service Started by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Systemd Shell Execution During Boot |
production |
2026-09-18 |
| elastic |
Unusual Process For a Linux Host |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Suspicious Mining Process Creation Event |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| sigma |
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators |
experimental |
2026-03-30 |
| sigma |
LiteLLM / TeamPCP Supply Chain Attack Indicators |
experimental |
2026-03-30 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Service Reload or Start - Linux |
test |
2025-03-03 |
| sigma |
Systemd Service Creation |
test |
2022-02-06 |