| elastic |
Microsoft Foundry Content Filter Modified or Deleted |
production |
2026-10-23 |
| elastic |
Kernel Module Removal |
production |
2026-10-09 |
| elastic |
Suspicious Kernel Feature Activity |
production |
2026-10-09 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-10-09 |
| elastic |
Microsoft Windows Defender Tampering |
production |
2026-10-07 |
| elastic |
OpenAI ChatGPT Enterprise Codex Security Scan Configuration Changed |
production |
2026-10-06 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-10-06 |
| elastic |
Google Workspace Bitlocker Setting Disabled |
production |
2026-10-06 |
| elastic |
ESXi Lockdown Mode Disabled |
production |
2026-09-30 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
ESXi Syslog Remote Host Reset |
production |
2026-09-30 |
| elastic |
ESXi Audit Records Disabled |
production |
2026-09-30 |
| elastic |
ESXi ExecInstalledOnly Protection Disabled |
production |
2026-09-30 |
| elastic |
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action |
production |
2026-09-25 |
| elastic |
AWS Bedrock Automated Reasoning Safety Policy Tampering |
production |
2026-09-25 |
| elastic |
AWS Bedrock Guardrail Deleted or Weakened |
production |
2026-09-25 |
| elastic |
GenAI CLI Started with Unsafe Permission Bypass |
production |
2026-09-25 |
| elastic |
AWS S3 Bucket Configuration Deletion |
production |
2026-09-18 |
| elastic |
AWS Security Hub Disabled |
production |
2026-09-18 |
| elastic |
AWS EventBridge Rule Disabled or Deleted |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Group Deletion |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Log Stream Deletion |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Deleted |
production |
2026-09-18 |
| elastic |
Azure Kubernetes Services (AKS) Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Azure VNet Network Watcher Deleted |
production |
2026-09-18 |
| elastic |
Azure Diagnostic Settings Alert Suppression Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Azure Resource Group Deleted |
production |
2026-09-18 |
| elastic |
GitHub Protected Branch Settings Changed |
production |
2026-09-18 |
| elastic |
GitHub Secret Scanning Disabled |
production |
2026-09-18 |
| elastic |
GitHub App Deleted |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Google Workspace Restrictions for Marketplace Modified to Allow Any App |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Anti-Phish Rule Modification |
production |
2026-09-18 |
| elastic |
M365 Exchange DKIM Signing Configuration Disabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Exchange DLP Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Link Policy Disabled |
production |
2026-09-18 |
| elastic |
M365 Exchange Mailbox Audit Logging Bypass Added |
production |
2026-09-18 |
| elastic |
M365 Exchange Malware Filter Policy Deleted |
production |
2026-09-18 |
| elastic |
M365 Exchange Malware Filter Rule Modified |
production |
2026-09-18 |
| elastic |
M365 Exchange Email Safe Attachment Rule Disabled |
production |
2026-09-18 |
| elastic |
M365 SharePoint Site Sharing Policy Weakened |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Modified |
production |
2026-09-18 |
| elastic |
Suspicious Write Attempt to AppArmor Policy Management Files |
production |
2026-09-18 |
| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
Attempt to Clear Kernel Ring Buffer |
production |
2026-09-18 |
| elastic |
Potential Disabling of AppArmor |
production |
2026-09-18 |
| elastic |
Potential Disabling of SELinux |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
SELinux Configuration Creation or Renaming |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
High Number of Process Terminations |
production |
2026-09-18 |
| elastic |
SoftwareUpdate Preferences Modification |
production |
2026-09-18 |
| elastic |
Quarantine Attrib Removed by Unsigned or Untrusted Process |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Potential Privacy Control Bypass via TCCDB Modification |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
Suspicious Antimalware Scan Interface DLL |
production |
2026-09-18 |
| elastic |
Potential Antimalware Scan Interface Bypass via PowerShell |
production |
2026-09-18 |
| elastic |
Potential AMSI Bypass via RPC Runtime Hooking |
production |
2026-09-18 |
| elastic |
Modification of AmsiEnable Registry Key |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Windows Defender Disabled via Registry Modification |
production |
2026-09-18 |
| elastic |
Windows Defender Exclusions Added via PowerShell |
production |
2026-09-18 |
| elastic |
Disabling Windows Defender Security Settings via PowerShell |
production |
2026-09-18 |
| elastic |
Potential EDR-Freeze via WerFaultSecure Abuse |
production |
2026-09-18 |
| elastic |
Disabling Lsa Protection via Registry Modification |
production |
2026-09-18 |
| elastic |
PowerShell Script with Windows Defender Tampering Capabilities |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Potential Evasion via Filter Manager |
production |
2026-09-18 |
| elastic |
WDAC Policy File by an Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Evasion via Windows Filtering Platform |
production |
2026-09-18 |
| elastic |
High Number of Process and/or Service Terminations |
production |
2026-09-18 |
| elastic |
Disabling User Account Control via Registry Modification |
production |
2026-09-18 |
| elastic |
Modification of Safari Settings via Defaults Command |
production |
2026-09-18 |
| elastic |
Elastic Agent Service Terminated |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Deleted |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Suspended |
production |
2026-09-18 |
| elastic |
AWS CloudWatch Alarm Deletion |
production |
2026-09-18 |
| elastic |
AWS Config Resource Deletion |
production |
2026-09-18 |
| elastic |
AWS Configuration Recorder Stopped |
production |
2026-09-18 |
| elastic |
AWS Detective Graph Deleted |
production |
2026-09-18 |
| elastic |
AWS EC2 Serial Console Access Enabled |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detector Deletion |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Detection Suppression |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Member Account Manipulation |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Publishing Destination Deleted |
production |
2026-09-18 |
| elastic |
AWS GuardDuty Threat Intelligence Set Deleted |
production |
2026-09-18 |
| elastic |
AWS Attempt to Leave Organization |
production |
2026-09-18 |
| elastic |
AWS Audit or Security Service Tampering via CLI |
production |
2026-09-14 |
| elastic |
Attempt to Disable IPTables or Firewall |
deprecated |
2022-07-25 |