| elastic |
Curl Execution via Shell Profile |
production |
2026-10-05 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
SSFileCopyReceiver Writing to Common Persistence Locations |
production |
2026-09-18 |
| elastic |
Bash Shell Profile Modification |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Shell Configuration Creation |
production |
2026-09-18 |
| splunk |
Linux Possible Append Command To Profile Config File |
production |
2026-08-12 |
| splunk |
Linux File Creation In Profile Directory |
production |
2026-05-13 |
| splunk |
Linux Auditd Unix Shell Configuration Modification |
production |
2026-05-13 |
| sigma |
Unix Shell Configuration Modification |
test |
2023-03-15 |