| elastic |
Unusual Pkexec Execution |
production |
2026-10-08 |
| elastic |
File Execution Permission Modification Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Potential Privacy Control Bypass via Localhost Secure Copy |
production |
2026-10-06 |
| elastic |
Excessive Sudo Authentication Failures via macOS Security Events |
production |
2026-10-06 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
Privilege Escalation via GDB CAP_SYS_PTRACE |
production |
2026-09-18 |
| elastic |
Suspicious Symbolic Link Created |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via CVE-2023-4911 |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via unshare and UID Change |
production |
2026-09-18 |
| elastic |
Potential Copy Fail (CVE-2026-31431) Exploitation via AF_ALG Socket |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Suspicious UID Change |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Parent Process Sequence |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via a Parent/Child Process Sequence |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via SUID/SGID |
production |
2026-09-18 |
| elastic |
Privilege Escalation via SUID/SGID |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via SUID/SGID Proxy Execution |
production |
2026-09-18 |
| elastic |
Potential Sudo Privilege Escalation via CVE-2019-14287 |
production |
2026-09-18 |
| elastic |
Potential Sudo Hijacking |
production |
2026-09-18 |
| elastic |
Potential Sudo Token Manipulation via Process Injection |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Python cap_setuid |
production |
2026-09-18 |
| elastic |
Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution |
production |
2026-09-18 |
| elastic |
Suspicious SUID Binary Execution (Auditd Sequence) |
production |
2026-09-18 |
| elastic |
Privilege Escalation via CAP_SETUID/SETGID Capabilities |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
UID Elevation from Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via TCCDB Modification |
production |
2026-09-18 |
| elastic |
Suspicious TCC Access Granted for User Folders |
production |
2026-09-18 |
| elastic |
Full Disk Access Permission Check |
production |
2026-09-18 |
| elastic |
Execution via Electron Child Process Node.js Module |
production |
2026-09-18 |
| elastic |
Apple Scripting Execution with Administrator Privileges |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| elastic |
Unusual Sudo Activity |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Disabling User Account Control via Registry Modification |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer |
production |
2026-09-18 |
| elastic |
UAC Bypass via ICMLuaUtil Elevated COM Interface |
production |
2026-09-18 |
| elastic |
UAC Bypass via DiskCleanup Scheduled Task Hijack |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Privileged IFileOperation COM Interface |
production |
2026-09-18 |
| elastic |
Bypass UAC via Event Viewer |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Windows Directory Masquerading |
production |
2026-09-18 |
| elastic |
UAC Bypass via Windows Firewall Snap-In Hijack |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Sudoers File Modification |
production |
2026-09-18 |
| elastic |
SUID/SGID Bit Set |
production |
2026-09-18 |
| elastic |
Sudoers File Activity |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRole with New MFA Device |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Profile Associated with Running Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Customer-Managed Policy Attached to Role by Rare User |
production |
2026-09-18 |
| elastic |
AWS IAM Customer Managed Policy Version Created or Default Version Set |
production |
2026-09-18 |
| elastic |
AWS KMS Key Policy Updated via PutKeyPolicy |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by Service |
production |
2026-09-18 |
| elastic |
AWS STS Role Assumption by User |
production |
2026-09-18 |
| elastic |
AWS STS AssumeRoot by Rare User and Member Account |
production |
2026-09-18 |
| elastic |
AWS STS GetFederationToken with AdministratorAccess in Request |
production |
2026-09-18 |
| elastic |
AWS STS Role Chaining |
production |
2026-09-18 |
| elastic |
Entra ID Actor Token User Impersonation Abuse |
production |
2026-09-18 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Spike in Privileged Command Execution by a User |
production |
2026-09-18 |
| elastic |
Unusual Process Detected for Privileged Commands by a User |
production |
2026-09-18 |
| elastic |
Potential Defense Evasion via Doas |
production |
2026-09-18 |
| elastic |
Sudo Command Enumeration Detected |
production |
2026-09-18 |
| elastic |
SUID/SGUID Enumeration Detected |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
System Binary Path File Permission Modification |
production |
2026-09-18 |
| elastic |
Process Capability Set via setcap Utility |
production |
2026-09-18 |
| elastic |
Setcap setuid/setgid Capability Set |
production |
2026-09-18 |
| elastic |
Potential Suspicious File Edit |
production |
2026-09-18 |
| elastic |
Potential Root Effective Shell from Non-Standard Path via Auditd |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-32463 Sudo Chroot Execution Attempt |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Enlightenment |
production |
2026-09-18 |
| sigma |
Registry Hive File Staged Outside Standard User Profile Path |
experimental |
2026-07-23 |
| elastic |
Deprecated - Sudo Heap-Based Buffer Overflow Attempt |
deprecated |
2026-07-02 |
| splunk |
Linux Persistence and Privilege Escalation Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows Privilege Escalation User Process Spawn System Process |
production |
2026-05-13 |
| splunk |
Windows Privilege Escalation System Process Without System Parent |
production |
2026-05-13 |
| splunk |
Allow Operation with Consent Admin |
production |
2026-05-13 |
| splunk |
Windows Privilege Escalation Suspicious Process Elevation |
production |
2026-05-13 |
| splunk |
Services Escalate Exe |
production |
2026-05-13 |
| splunk |
Linux Telnet Authentication Bypass |
production |
2026-05-13 |
| sigma |
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 |
experimental |
2026-04-28 |
| elastic |
Deprecated - Network Connection via Sudo Binary |
deprecated |
2026-02-04 |
| sigma |
Linux Setuid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| sigma |
Linux Setgid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Potential Privilege Escalation via Local Kerberos Relay over LDAP |
test |
2024-08-13 |
| sigma |
CA Policy Updated by Non Approved Actor |
test |
2024-05-28 |
| sigma |
GCP Break-glass Container Workload Deployed |
test |
2024-01-12 |
| sigma |
COM Hijack via Sdclt |
test |
2023-09-28 |
| elastic |
Suspicious Network Connection Attempt by Root |
deprecated |
2023-07-31 |
| sigma |
Linux Doas Conf File Creation |
stable |
2022-12-31 |
| sigma |
Linux Capabilities Discovery |
test |
2022-12-25 |
| sigma |
Vulnerable Netlogon Secure Channel Connection Allowed |
test |
2022-12-25 |
| sigma |
AWS Suspicious SAML Activity |
test |
2022-12-18 |
| sigma |
Abused Debug Privilege by Arbitrary Parent Processes |
test |
2022-11-11 |
| sigma |
AWS STS AssumeRole Misuse |
test |
2022-10-09 |
| sigma |
Credential Dumping Attempt Via Svchost |
test |
2022-10-09 |
| sigma |
Regedit as Trusted Installer |
test |
2022-10-09 |
| sigma |
AWS STS GetSessionToken Misuse |
test |
2022-10-09 |
| sigma |
UAC Bypass via Windows Firewall Snap-In Hijack |
test |
2022-09-27 |
| sigma |
SCM Database Privileged Operation |
test |
2022-09-18 |
| sigma |
User Removed From Group With CA Policy Modification Access |
test |
2022-08-04 |
| sigma |
User Added To Group With CA Policy Modification Access |
test |
2022-08-04 |
| elastic |
Potential Privilege Escalation via Local Kerberos Relay over LDAP |
deprecated |
2022-08-01 |
| sigma |
CA Policy Removed by Non Approved Actor |
test |
2022-07-19 |
| sigma |
New CA Policy by Non-approved Actor |
test |
2022-07-18 |
| sigma |
Linux Doas Tool Execution |
stable |
2022-01-20 |
| elastic |
Setgid Bit Set via chmod |
deprecated |
2021-03-16 |
| sentinel |
Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attempt |
Scheduled |
— |