edr:elastic-defend file
file
Stands in for win:sysmon 11 (full), win:sysmon 23 (full), linux:sysmon 11 (full), linux:auditd PATH (partial), linux:auditd SYSCALL:open (partial), linux:auditd SYSCALL:chmod (partial)
- Log source
- Elastic Defend endpoint events
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Elastic Agent with the Elastic Defend integration; datasets logs-endpoint.events.*.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Elastic 195
Why this tier
ATT&CK via equivalence to win:sysmon 11; ATT&CK via equivalence to win:sysmon 23
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
Elastic 195
- APT Package Manager Configuration File Creation
- AWS CLI Configuration Modified by Unusual Process
- Abnormal Process ID or Lock File Created
- Alternate Data Stream Creation/Execution at Volume Root Directory
- Archive File with Unusual Extension
- At Job Created or Modified
- Authorization Plugin Modification
- Bash Shell Profile Modification
- Binfmt Configuration File Creation
- Browser Extension Install
- Claude Cowork VM Boot Image Tamper
- Creation of Hidden Launch Agent or Daemon
- Creation of Hidden Shared Object File
- Creation of SettingContent-ms Files
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of a new GPO Scheduled Task or Service
- Cron Job Created or Modified
- D-Bus Service Created
- DNF Package Manager Plugin File Creation
- Discovery Command Output Written to Suspicious File
- Docker Release File Creation
- Downloaded Shortcut Files
- Downloaded URL Files
- Dracut Module Creation
- Dynamic Linker (ld.so) Creation
- Dynamic Linker Copy
- Dynamic Linker Creation
- ELF Binary Created in System Directory by Suspicious Process
- ELF Payload Staged in a Suspicious Directory
- Elastic Defend Alert Followed by Telemetry Loss
- Emond Rules Creation or Modification
- Executable File Creation with Multiple Extensions
- Executable File Download via Wget
- Executable File with Unusual Extension
- Execution of File Written or Modified by Microsoft Office
- Execution of a Downloaded Windows Script
- Execution via local SxS Shared Module
- File Compressed or Archived into Common Format by Unsigned Process
- File Creation by Cups or Foomatic-rip Child
- File Creation in /var/log via Suspicious Process
- File Creation in World-Writable Directory by Unusual Process
- File Creation, Execution and Self-Deletion in Suspicious Directory
- File Staged in Root Folder of Recycle Bin
- File with High Entropy Created by Web Server
- File with Right-to-Left Override Character (RTLO) Created/Executed
- File with Suspicious Double Extension Created by Web Server
- File with Suspicious Extension Downloaded
- First Time Python Accessed Sensitive Credential Files
- First Time Python Created a LaunchAgent or LaunchDaemon
- Full Disk Access Permission Check
- GRUB Configuration File Creation
- GenAI Agent Instruction File Written to Downloads
- GenAI Process Accessing Sensitive Files
- Git Hook Created or Modified
- Git Repository or File Download to Suspicious Directory
- Hidden File Created in System Directory by Suspicious Process
- Hidden Files and Directories via Hidden Flag
- Host File System Changes via Windows Subsystem for Linux
- Hosts File Modified
- Ingress Transfer via Windows BITS
- Initial Access via File Upload Followed by GET Request
- KDE AutoStart Script or Desktop File Creation
- Kernel Object File Creation
- Kirbi File Creation
- Kubeconfig File Creation or Modification
- Kubernetes Sensitive Configuration File Activity
- LSASS Memory Dump Creation
- Lateral Movement via Startup Folder
- Launch Service Creation and Immediate Loading
- Loadable Kernel Module Configuration File Creation
- Mark-of-the-Web Removal by an Unusual Process
- Memory Dump File with Unusual Extension
- Message-of-the-Day (MOTD) File Creation
- Microsoft Exchange Server UM Writing Suspicious Files
- Mimikatz Memssp Log File Detected
- Modification of Dynamic Linker Preload Shared Object
- Multiple Credential Access by VS Code or Cursor IDE Descendant
- Network Connection Followed by File Creation
- Network Connection via Recently Compiled Executable
- NetworkManager Dispatcher Script Creation
- PHP File Creation in WordPress Plugin Directory
- Package Runtime Secret File Access Followed by IMDS Request
- Persistence via DirectoryService Plugin Modification
- Persistence via Docker Shortcut Modification
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via Suspicious Launch Agent or Launch Daemon
- Persistence via a Hidden Plist Filename
- Persistence via a Windows Installer
- Persistent Scripts in the Startup Directory
- Pluggable Authentication Module (PAM) Creation in Unusual Directory
- Pluggable Authentication Module or Configuration Creation
- Polkit Policy Creation
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential Credential Access via Memory Dump File Creation
- Potential Defense Evasion via Doas
- Potential Etherhiding C2 via Blockchain Connection
- Potential Evasion via Boot Time Removal Tool
- Potential IIS Web Shell File Creation
- Potential Lateral Tool Transfer via SMB Share
- Potential Linux Ransomware Note Creation Detected
- Potential Microsoft Office Sandbox Evasion
- Potential OpenSSH Backdoor Logging Activity
- Potential Persistence via Atom Init Script Modification
- Potential Persistence via Login Hook
- Potential Persistence via Mandatory User Profile
- Potential Persistence via Periodic Tasks
- Potential Polyglot Bypass File Created by Web Server
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Recently Compiled Executable
- Potential REMCOS Trojan Execution
- Potential Ransomware Behavior - Note Files by System
- Potential Ransomware Note File Dropped via SMB
- Potential Remote Credential Access via Registry
- Potential SAP NetWeaver WebShell Creation
- Potential Secure File Deletion via SDelete Utility
- Potential Sudo Hijacking
- Potential Suspicious File Edit
- Potential System Tampering via File Modification
- Potential Webshell Deployed via Apache Struts CVE-2023-50164 Exploitation
- Potential privilege escalation via CVE-2022-38028
- Potential snap-confine Privilege Escalation via CVE-2026-3888
- Privilege Escalation via CAP_CHOWN/CAP_FOWNER Capabilities
- Privilege Escalation via Root Crontab File Modification
- Process Execution Followed by Self-Deletion
- Python Path File (pth) Creation
- Python Site or User Customize File Creation
- Quarantine Attrib Removed by Unsigned or Untrusted Process
- ROT Encoded Python Script Execution
- Remote Execution via File Shares
- Remote File Copy via TeamViewer
- Remote File Creation in World Writeable Directory
- Remote File Download via PowerShell
- Remote File Download via Script Interpreter
- Renaming of OpenSSH Binaries
- SELinux Configuration Creation or Renaming
- SSFileCopyReceiver Writing to Common Persistence Locations
- SSH Authorized Keys File Activity
- SSH Authorized Keys File Deletion
- SSH Key Generated via ssh-keygen
- SSL Certificate Deletion
- Screensaver Plist File Modified by Unexpected Process
- Sensitive File Access followed by Compression
- Sensitive Registry Hive Access via RegBack
- Shadow File Modification by Unusual Process
- Shared Object Created by Previously Unknown Process
- Shell Configuration Creation
- Shortcut File Written or Modified on Startup Folder
- Startup Folder Persistence via Unsigned Process
- Startup Persistence by a Suspicious Process
- Sublime Plugin or Application Script Modification
- Sudoers File Activity
- Suspicious Antimalware Scan Interface DLL
- Suspicious Apple Mail Rule Plist Modification
- Suspicious Calendar File Modification
- Suspicious CronTab Creation or Modification
- Suspicious File Creation via Kworker
- Suspicious File Creation via Pkg Install Script
- Suspicious File Renamed via SMB
- Suspicious HTML File Creation
- Suspicious Java Class File Created in PaperCut Server Library
- Suspicious Managed Code Hosting Process
- Suspicious Mining Process Creation Event
- Suspicious Passwd File Event Action
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler SPL File Created
- Suspicious Renaming of ESXI Files
- Suspicious StartupItem Plist Creation
- Suspicious Web Browser Sensitive File Access
- System Binary Moved or Copied
- System Log File Deletion
- System V Init Script Created
- System and Network Configuration Check
- Systemd Generator Created
- Systemd Service Created
- Systemd Service Override Configuration File Created
- Systemd Timer Created
- Systemd-udevd Rule File Creation
- Third-party Backup Files Deleted via Unexpected Process
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- Unusual Executable File Creation by a System Critical Process
- Unusual File Creation - Alternate Data Stream
- Unusual File Creation by Web Server
- Unusual File Creation via Web Server
- Unusual File Operation by dns.exe
- Unusual Process Modifying GenAI Configuration File
- Unusual Remote File Creation
- Unusual Web Config File Access
- WDAC Policy File by an Unusual Process
- WebServer Access Logs Deleted
- Windows Registry File Creation in SMB Share
- Yum Package Manager Plugin File Creation
- rc.local/rc.common File Creation