| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-10-08 |
| elastic |
Creation of Hidden Files and Directories via CommandLine |
production |
2026-10-08 |
| elastic |
Hidden File Created in System Directory by Suspicious Process |
production |
2026-10-07 |
| elastic |
Persistence via a Hidden Plist Filename via macOS Security Events |
production |
2026-10-06 |
| elastic |
Claude Cowork VM Boot Image Tamper |
production |
2026-09-25 |
| elastic |
Persistence via Hidden Run Key Detected |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
Unusual Login via System User |
production |
2026-09-18 |
| elastic |
Potential Hidden Local User Account Creation |
production |
2026-09-18 |
| elastic |
Suspicious Hidden Child Process of Launchd |
production |
2026-09-18 |
| elastic |
Creation of Hidden Launch Agent or Daemon |
production |
2026-09-18 |
| elastic |
Persistence via a Hidden Plist Filename |
production |
2026-09-18 |
| elastic |
Adding Hidden File Attribute via Attrib |
production |
2026-09-18 |
| elastic |
Potential Evasion via Boot Time Removal Tool |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Windows Sandbox with Sensitive Configuration |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Unusual File Creation - Alternate Data Stream |
production |
2026-09-18 |
| elastic |
Unusual Process Execution Path - Alternate Data Stream |
production |
2026-09-18 |
| elastic |
Creation of a Hidden Local User Account |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Rule with Obfuscated Name |
production |
2026-09-18 |
| elastic |
M365 Exchange Inbox Phishing Evasion Rule Created |
production |
2026-09-18 |
| elastic |
High Number of Egress Network Connections from Unusual Executable |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
Hidden Files and Directories via Hidden Flag |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Hidden Directory Creation via Unusual Parent |
production |
2026-09-18 |
| elastic |
Creation of Hidden Shared Object File |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Potential Hidden Process via Mount Hidepid |
production |
2026-09-18 |
| elastic |
Suspicious Path Mounted |
production |
2026-09-18 |
| elastic |
System Binary Symlink to Suspicious Location |
production |
2026-09-18 |
| elastic |
Potential Uninstall Entry Concealment |
production |
2026-09-17 |
| sigma |
Sysmon Configuration Error |
test |
2026-07-23 |
| splunk |
Windows New Service Security Descriptor Set Via Sc.EXE |
production |
2026-05-13 |
| splunk |
Windows New Deny Permission Set On Service SD Via Sc.EXE |
production |
2026-05-13 |
| sigma |
Virtualbox Driver Installation or Starting of VMs |
test |
2025-07-29 |
| sigma |
PUA - System Informer Execution |
test |
2024-11-23 |
| sigma |
PUA - Process Hacker Execution |
test |
2024-11-23 |
| sigma |
Potentially Suspicious Execution From Parent Process In Public Folder |
test |
2024-07-12 |
| sigma |
Suspicious Executable File Creation |
test |
2023-12-11 |
| sigma |
CrashControl CrashDump Disabled |
test |
2023-08-17 |
| sigma |
Mount Execution With Hidepid Parameter |
test |
2023-01-12 |
| sigma |
Suspicious Creation with Colorcpl |
test |
2023-01-05 |
| sigma |
Sysmon Configuration Modification |
test |
2022-08-02 |
| sentinel |
Malware in the recycle bin (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Fake computer account created |
Scheduled |
— |
| sentinel |
Missing Domain Controller Heartbeat |
Scheduled |
— |