| elastic |
AWS EKS Admission Webhook Created or Modified |
production |
2026-10-21 |
| elastic |
Suspicious Calendar File Modification |
production |
2026-10-06 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-10-06 |
| elastic |
Curl Execution via Shell Profile |
production |
2026-10-05 |
| splunk |
Windows AD AdminSDHolder ACL Modified |
production |
2026-09-22 |
| elastic |
Uncommon Registry Persistence Change |
production |
2026-09-18 |
| elastic |
Suspicious WerFault Child Process |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
Mofcomp Activity |
production |
2026-09-18 |
| elastic |
Installation of Custom Shim Databases |
production |
2026-09-18 |
| elastic |
Registry Persistence via AppCert DLL |
production |
2026-09-18 |
| elastic |
Registry Persistence via AppInit DLL |
production |
2026-09-18 |
| elastic |
Image File Execution Options Injection |
production |
2026-09-18 |
| elastic |
Netsh Helper DLL |
production |
2026-09-18 |
| elastic |
Persistence via PowerShell profile |
production |
2026-09-18 |
| elastic |
Potential Modification of Accessibility Binaries |
production |
2026-09-18 |
| elastic |
Component Object Model Hijacking |
production |
2026-09-18 |
| elastic |
Suspicious WMI Event Subscription Created |
production |
2026-09-18 |
| elastic |
Potential Application Shimming via Sdbinst |
production |
2026-09-18 |
| elastic |
Persistence via WMI Event Subscription |
production |
2026-09-18 |
| elastic |
Werfault ReflectDebugger Persistence |
production |
2026-09-18 |
| elastic |
Bash Shell Profile Modification |
production |
2026-09-18 |
| elastic |
Trap Signals Execution |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Policy Updated to Allow Public Invocation |
production |
2026-09-18 |
| elastic |
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation |
production |
2026-09-18 |
| elastic |
AWS Lambda Event Source Mapping Creation |
production |
2026-09-18 |
| elastic |
AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content |
production |
2026-09-18 |
| elastic |
Azure Automation Webhook Created |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential release_agent Container Escape Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
GKE Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
Kubernetes Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
APT Package Manager Configuration File Creation |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
Binfmt Configuration File Creation |
production |
2026-09-18 |
| elastic |
D-Bus Service Created |
production |
2026-09-18 |
| elastic |
DNF Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Shell Configuration Creation |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| elastic |
Systemd-udevd Rule File Creation |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
Yum Package Manager Plugin File Creation |
production |
2026-09-18 |
| elastic |
Docker Release File Creation |
production |
2026-09-18 |
| elastic |
Suspicious Apple Mail Rule Plist Modification |
production |
2026-09-18 |
| elastic |
Emond Rules Creation or Modification |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Persistence via Folder Action Script |
production |
2026-09-18 |
| elastic |
Unexpected Child Process of macOS Screensaver Engine |
production |
2026-09-18 |
| elastic |
Screensaver Plist File Modified by Unexpected Process |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Pkg Install Script |
production |
2026-09-18 |
| elastic |
Potential Persistence via Atom Init Script Modification |
production |
2026-09-18 |
| splunk |
Python PTH File Creation During Package Installation |
production |
2026-08-21 |
| splunk |
Python Site Hooks Creation During Package Installation |
production |
2026-08-21 |
| splunk |
Windows Compatibility Telemetry Suspicious Child Process |
production |
2026-05-13 |
| splunk |
Windows Compatibility Telemetry Tampering Through Registry |
production |
2026-05-13 |
| sigma |
Control Panel Items |
test |
2023-10-11 |
| sigma |
COM Hijack via Sdclt |
test |
2023-09-28 |
| sigma |
Outlook Macro Execution Without Warning Setting Enabled |
test |
2023-08-17 |
| sigma |
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting |
test |
2023-08-17 |
| sigma |
HAFNIUM Exchange Exploitation Activity |
test |
2023-03-09 |
| sigma |
New Outlook Macro Created |
test |
2023-02-08 |
| sigma |
Suspicious Outlook Macro Created |
test |
2023-02-08 |
| sigma |
SOURGUM Actor Behaviours |
test |
2022-10-09 |
| sigma |
MSSQL Extended Stored Procedure Backdoor Maggie |
test |
2022-10-09 |
| sigma |
Suspicious Get-Variable.exe Creation |
test |
2022-04-23 |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) |
Scheduled |
— |