| elastic |
Kernel Module Removal |
production |
2026-10-09 |
| elastic |
Network Connections Initiated Through XDG Autostart Entry |
production |
2026-10-08 |
| elastic |
Startup/Logon Script added to Group Policy Object |
production |
2026-10-06 |
| elastic |
Persistence via a Hidden Plist Filename via macOS Security Events |
production |
2026-10-06 |
| elastic |
Kernel Object File Creation |
production |
2026-10-05 |
| elastic |
Startup or Run Key Registry Modification |
production |
2026-10-05 |
| elastic |
Persistence via a Windows Installer |
production |
2026-10-05 |
| elastic |
KDE AutoStart Script or Desktop File Creation |
production |
2026-10-05 |
| elastic |
Potential Port Monitor or Print Processor Registration Abuse |
production |
2026-09-18 |
| elastic |
Mimikatz Memssp Log File Detected |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Lateral Movement via Startup Folder |
production |
2026-09-18 |
| elastic |
Suspicious Startup Shell Folder Modification |
production |
2026-09-18 |
| elastic |
Uncommon Registry Persistence Change |
production |
2026-09-18 |
| elastic |
Execution of Persistent Suspicious Program |
production |
2026-09-18 |
| elastic |
Startup Persistence by a Suspicious Process |
production |
2026-09-18 |
| elastic |
Startup Folder Persistence via Unsigned Process |
production |
2026-09-18 |
| elastic |
Persistent Scripts in the Startup Directory |
production |
2026-09-18 |
| elastic |
Potential Persistence via Mandatory User Profile |
production |
2026-09-18 |
| elastic |
Potential Persistence via Time Provider Modification |
production |
2026-09-18 |
| elastic |
Persistence via Hidden Run Key Detected |
production |
2026-09-18 |
| elastic |
Installation of Security Support Provider |
production |
2026-09-18 |
| elastic |
Persistence via WMI Standard Registry Provider |
production |
2026-09-18 |
| elastic |
First Time Seen Driver Loaded |
production |
2026-09-18 |
| elastic |
Potential LSA Authentication Package Abuse |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Suspicious Usage of bpf_probe_write_user Helper |
production |
2026-09-18 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
Kernel Module Load via Built-in Utility |
production |
2026-09-18 |
| elastic |
Kernel Driver Load |
production |
2026-09-18 |
| elastic |
Kernel Driver Load by non-root User |
production |
2026-09-18 |
| elastic |
Kernel Module Load from Unusual Location |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Loadable Kernel Module Configuration File Creation |
production |
2026-09-18 |
| elastic |
Executable Bit Set for Potential Persistence Script |
production |
2026-09-18 |
| elastic |
Tainted Kernel Module Load |
production |
2026-09-18 |
| elastic |
Kernel Module Loaded with Tainting Flags |
production |
2026-09-18 |
| elastic |
Tainted Out-Of-Tree Kernel Module Load |
production |
2026-09-18 |
| elastic |
Kernel Load or Unload via Kexec Detected |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
Creation of Hidden Login Item via Apple Script |
production |
2026-09-18 |
| elastic |
Authorization Plugin Modification |
production |
2026-09-18 |
| elastic |
Persistence via DirectoryService Plugin Modification |
production |
2026-09-18 |
| elastic |
Persistence via Docker Shortcut Modification |
production |
2026-09-18 |
| elastic |
Persistence via a Hidden Plist Filename |
production |
2026-09-18 |
| elastic |
Potential Persistence via Login Hook |
production |
2026-09-18 |
| elastic |
Persistence via Suspicious Launch Agent or Launch Daemon |
production |
2026-09-18 |
| elastic |
Potential REMCOS Trojan Execution |
production |
2026-09-18 |
| elastic |
Suspicious Module Loaded by LSASS |
production |
2026-09-18 |
| splunk |
Linux UDEV Rule Created |
production |
2026-07-08 |
| splunk |
Linux MOTD Script Added |
production |
2026-07-08 |
| splunk |
Linux Suspicious XDG Autostart |
production |
2026-07-08 |
| splunk |
Linux File Creation In System Generator Directory |
production |
2026-07-08 |
| splunk |
Windows Unsigned MS DLL Side-Loading |
production |
2026-05-13 |
| elastic |
Deprecated - Creation of Kernel Module |
deprecated |
2026-02-04 |
| sigma |
Startup/Logon Script Added to Group Policy Object |
test |
2024-09-06 |
| sigma |
Atbroker Registry Change |
test |
2023-01-19 |
| sigma |
Potential RipZip Attack on Startup Folder |
test |
2023-01-05 |
| sigma |
Registry Persistence Mechanisms in Recycle Bin |
test |
2022-12-06 |
| sigma |
Suspicious Driver Install by pnputil.exe |
test |
2022-10-09 |
| sigma |
Suspicious GrpConv Execution |
test |
2022-05-19 |
| sigma |
WINEKEY Registry Modification |
test |
2021-11-27 |
| elastic |
Persistence via Kernel Module Modification |
deprecated |
2021-04-15 |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript |
Scheduled |
— |
| sentinel |
Midnight Blizzard - suspicious rundll32.exe execution of vbscript (Normalized Process Events) |
Scheduled |
— |