| elastic |
Suspicious Kernel Feature Activity |
production |
2026-10-09 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
ESXi Attempt to Force Install a VMware VIB Package |
production |
2026-09-30 |
| elastic |
Mark-of-the-Web Removal by an Unusual Process |
production |
2026-09-25 |
| elastic |
Suspicious Outbound Network Connection via Unsigned Binary |
production |
2026-09-18 |
| elastic |
Quarantine Attrib Removed by Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Attempt to Disable Gatekeeper |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Code Signing Policy Modification Through Built-in tools |
production |
2026-09-18 |
| elastic |
Code Signing Policy Modification Through Registry |
production |
2026-09-18 |
| elastic |
Creation or Modification of Root Certificate |
production |
2026-09-18 |
| elastic |
Windows CryptoAPI Spoofing Vulnerability (CVE-2020-0601 - CurveBall) |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
SIP Provider Modification |
production |
2026-09-18 |
| elastic |
Expired or Revoked Driver Loaded |
production |
2026-09-18 |
| elastic |
Attempt to Install Root Certificate |
production |
2026-09-18 |
| elastic |
Root Certificate Installation |
production |
2026-09-18 |
| elastic |
SSL Certificate Deletion |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| sigma |
Suspicious RazerInstaller Explorer Subprocess |
test |
2024-12-01 |
| sigma |
Potential BOINC Software Execution (UC-Berkeley Signature) |
test |
2024-07-23 |
| sigma |
Renamed BOINC Client Execution |
test |
2024-07-23 |
| sigma |
Suspicious Execution via macOS Script Editor |
test |
2022-12-28 |