| elastic |
AWS EKS Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected |
production |
2026-10-21 |
| splunk |
Ollama Possible API Endpoint Scan Reconnaissance |
production |
2026-10-09 |
| splunk |
Attacker Tools On Endpoint |
production |
2026-09-22 |
| elastic |
GKE Anonymous Endpoint Permission Enumeration |
production |
2026-09-18 |
| elastic |
Spike in Firewall Denies |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic |
production |
2026-09-18 |
| elastic |
Spike in Network Traffic To a Country |
production |
2026-09-18 |
| elastic |
ICMP Timestamp or Information Request from the Internet |
production |
2026-09-18 |
| elastic |
Potential Network Sweep Detected |
production |
2026-09-18 |
| elastic |
Potential Network Scan Detected |
production |
2026-09-18 |
| elastic |
Potential SIP Extension Enumeration |
production |
2026-09-18 |
| elastic |
Potential SYN-Based Port Scan Detected |
production |
2026-09-18 |
| elastic |
Inbound Connection to an Unsecure Elasticsearch Node |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Potential SQL Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Discovery or Fuzzing Activity |
production |
2026-09-18 |
| elastic |
Potential Spike in Web Server Error Logs |
production |
2026-09-18 |
| elastic |
Web Server Potential Spike in Error Response Codes |
production |
2026-09-18 |
| elastic |
Web Server Suspicious User Agent Requests |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launch Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected |
production |
2026-09-18 |
| elastic |
Suspicious Network Tool Launched Inside A Container |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| splunk |
Cisco SA - Automated Web Reconnaissance via HTTP Access Errors |
production |
2026-06-09 |
| splunk |
Cisco SD-WAN Multiple SSH key Authentication from Same Source |
production |
2026-06-09 |
| splunk |
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication |
production |
2026-06-09 |
| splunk |
HTTP Rapid POST with Mixed Status Codes |
production |
2026-05-13 |
| splunk |
Windows Netspy Network Scanner Execution |
production |
2026-05-13 |
| splunk |
Cisco SD-WAN - Uncommon User-Agent Multi-URI Activity |
production |
2026-05-13 |
| sigma |
Potential Hello-World Scraper Botnet Activity |
experimental |
2025-08-02 |
| sigma |
PUA - PingCastle Execution From Potentially Suspicious Parent |
test |
2024-01-11 |
| sigma |
PUA - PingCastle Execution |
test |
2024-01-11 |