edr:elastic-defend process
process
Stands in for win:sysmon 1 (full), win:security 4688 (full), linux:auditd EXECVE (full), linux:sysmon 1 (full)
- Log source
- Elastic Defend endpoint events
- Host type
- EDR sensors (product telemetry, cross-platform)
- How to enable
- Elastic Agent with the Elastic Defend integration; datasets logs-endpoint.events.*.
- Tier, host type
- Minimum
- Techniques
- 0
- Rules depending on it
- Elastic 680
Why this tier
ATT&CK via equivalence to win:sysmon 1; ATT&CK via equivalence to win:security 4688; ATT&CK via equivalence to linux:auditd EXECVE
By role
| Role | Tier | Basis |
|---|---|---|
| Windows workstationEDR path | Minimum | |
| Windows member serverEDR path | Minimum | |
| Windows domain controllerEDR path | Minimum | |
| Windows web server (IIS), internet-facingEDR path | Minimum | |
| Linux serverEDR path | Minimum | |
| Linux web server, internet-facingEDR path | Minimum | |
| macOS endpointEDR path | Minimum |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
400 of 680 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Elastic 400 listed of 680
- AWS Audit or Security Service Tampering via CLI
- AWS CLI Command with Custom Endpoint URL
- AWS Credentials Searched For Inside A Container
- AWS EC2 LOLBin Execution via SSM SendCommand
- AWS SSM Agent Registered via Hybrid Activation
- AWS SSM Session Manager Child Process Execution
- AWS SSM `SendCommand` with Run Shell Command Parameters
- Access Control List Modification via setfacl
- Accessing Outlook Data Files
- Account Discovery Command via SYSTEM Account
- Account or Group Discovery via Built-In Tools
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Alternate Data Stream Creation/Execution at Volume Root Directory
- AppArmor Profile Compilation via apparmor_parser
- Apple Script Execution followed by Network Connection
- Apple Scripting Execution with Administrator Privileges
- At.exe Command Lateral Movement
- Attempt to Clear Kernel Ring Buffer
- Attempt to Clear Logs via Journalctl
- Attempt to Disable Auditd Service
- Attempt to Disable Gatekeeper
- Attempt to Disable IPTables or Firewall
- Attempt to Disable Syslog Service
- Attempt to Enable the Root Account
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install Root Certificate
- Attempt to Install or Run Kali Linux via WSL
- Attempt to Mount SMB Share via Command Line
- Attempt to Unload Elastic Endpoint Security Kernel Extension
- Attempted Private Key Access
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- Azure Run Command Correlated with Process Execution
- Azure Run Command Script Child Process
- Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation
- BPF Program Tampering via bpftool
- BPF Program or Map Load via bpftool
- BPF filter applied using TC
- Backup Deletion with Wbadmin
- Base16 or Base32 Encoding/Decoding Activity
- Base64 Decoded Payload Piped to Interpreter
- Binary Content Copy via Cmd.exe
- Binary Executed from Shared Memory Directory
- Bitsadmin Activity
- Boot File Copy
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Chkconfig Service Add
- Chroot Execution in Container Context on Linux
- Clearing Windows Console History
- Clearing Windows Event Logs
- Cloud Offensive Framework Execution
- Code Signing Policy Modification Through Built-in tools
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Conhost Spawned By Suspicious Parent Process
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Container Management Utility Run Inside A Container
- Container Runtime CLI Execution with Suspicious Arguments
- Control Panel Process with Unusual Arguments
- Creation of Hidden Files and Directories via CommandLine
- Creation of Hidden Login Item via Apple Script
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Cupsd or Foomatic-rip Shell Execution
- Curl Download Activity from npm Package Install
- Curl Execution via Shell Profile
- Curl SOCKS Proxy Activity from Unusual Parent
- Curl or Wget Egress Network Connection via LoLBin
- Curl or Wget Spawned via Node.js
- DPKG Package Installed by Unusual Parent Process
- Data Encrypted via OpenSSL Utility
- Delayed Execution via Ping
- Delete Volume USN Journal with Fsutil
- Direct Process Execution via Background Utility
- Directory Creation in /bin directory
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Windows Defender Security Settings via PowerShell
- Discovery Command Output Written to Suspicious File
- Discovery of Domain Groups
- Discovery of Internet Capabilities via Built-in Tools
- Docker Socket Enumeration
- Dumping Account Hashes via Built-In Commands
- Dumping of Keychain Content via Security Command
- Dylib Injection via Process Environment Variables
- Dynamic Linker Copy
- ESXI Discovery via Find
- ESXI Discovery via Grep
- ESXI Timestomping using Touch Command
- Egress Connection from Entrypoint in Container
- Elastic Agent Service Terminated
- Elastic Defend Alert Followed by Telemetry Loss
- Elastic Defend Alert from GenAI Utility or Descendant
- Elastic Defend Alert from Package Manager Install Ancestry
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Enumeration of Users or Groups via Built-in Commands
- Executable Bit Set for Potential Persistence Script
- Executable Masquerading as Kernel Process
- Execution from Unusual Directory - Command Line
- Execution from a Removable Media with Network Connection
- Execution of COM object via Xwizard
- Execution of File Written or Modified by Microsoft Office
- Execution of Persistent Suspicious Program
- Execution of a Downloaded Windows Script
- Execution of an Unsigned Service
- Execution via Electron Child Process Node.js Module
- Execution via GitHub Actions Runner
- Execution via MS VisualStudio Pre/Post Build Events
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via Microsoft DotNet ClickOnce Host
- Execution via OpenClaw Agent
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution with Explicit Credentials via Scripting
- Exporting Exchange Mailbox via PowerShell
- External IP Address Discovery via Curl
- File Creation by Cups or Foomatic-rip Child
- File Creation, Execution and Self-Deletion in Suspicious Directory
- File Deletion via Shred
- File Downloaded by Curl/Wget and Piped to Interpreter
- File Permission Modification in Writable Directory
- File System Debugger Launched Inside a Container
- File Transfer Utility Launched from Unusual Parent
- File Transfer or Listener Established via Netcat
- File and Directory Permissions Modification
- File made Immutable by Chattr
- File or Directory Deletion Command
- File with Right-to-Left Override Character (RTLO) Created/Executed
- Finder Sync Plugin Registered and Enabled
- First Time Python Spawned a Shell on Host
- First Time Seen RMM Signer Across the Environment
- First Time Seen Remote Monitoring and Management Tool
- GRUB Configuration Generation through Built-in Utilities
- GenAI CLI Started with Unsafe Permission Bypass
- GenAI Process Compiling or Generating Executables
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Git Hook Child Process
- Git Hook Command Execution
- Git Hook Egress Network Connection
- Git Repository or File Download to Suspicious Directory
- GitHub Authentication Token Access via Node.js
- Group Policy Discovery via Microsoft GPResult Utility
- Hidden Directory Creation via Unusual Parent
- High Number of Process Terminations
- High Number of Process and/or Service Terminations
- Host File System Changes via Windows Subsystem for Linux
- Hosts File Modified
- Hping Process Activity
- IIS HTTP Logging Disabled
- IPv4/IPv6 Forwarding Activity
- ImageLoad via Windows Update Auto Update Client
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- Indirect Command Execution via Forfiles/Pcalua
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- InstallUtil Activity
- InstallUtil Process Making Network Connections
- Interactive Shell Launched via Unusual Parent Process in a Container
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python
- Java Dropped and Executed With DNS Lookup
- Kerberos Cached Credentials Dumping
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Load from Unusual Location
- Kernel Module Load via Built-in Utility
- Kernel Module Loaded with Tainting Flags
- Kernel Module Removal
- Kernel Seeking Activity
- Kernel Unpacking Activity
- Keychain CommandLine Interaction via Unsigned or Untrusted Process
- Keychain Password Retrieval via Command Line
- Kill Command Execution
- Kubeconfig File Discovery
- Kubectl Apply Pod from URL
- Kubectl Configuration Discovery
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubernetes Direct API Request via Curl or Wget
- Kubernetes Service Account Secret Access
- Kubernetes Static Pod Manifest File Access
- Kubernetes and Cloud Credential Path Access via Process Arguments
- LLM-Based Curl Activity Triage
- LLM-Based Wget Activity Triage
- Launch Service Creation and Immediate Loading
- Linux Audio Recording Activity Detected
- Linux Clipboard Activity Detected
- Linux External IP Address Discovery via Curl
- Linux Firewall Rule Creation or Modification
- Linux Process Hooking via GDB
- Linux SSH X11 Forwarding
- Linux System Information Discovery
- Linux System Information Discovery via Getconf
- Linux Telegram API Request
- Linux User Account Credential Modification
- Linux User Added to Privileged Group
- Linux Video Recording or Screenshot Activity Detected
- Linux init (PID 1) Secret Dump via GDB
- Local Scheduled Task Creation
- Long Base64 Encoded Command via Scripting Interpreter
- Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
- Manual Dracut Execution
- Manual Loading of a Suspicious Chromium Extension
- Manual Memory Dumping via Proc Filesystem
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Masquerading Space After Filename
- Memory Swap Modification
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a Script Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Modification of Boot Configuration
- Modification of Environment Variable via Unsigned or Untrusted Parent
- Modification of Safari Settings via Defaults Command
- Mofcomp Activity
- Mount Launched Inside a Container
- Mounting Hidden or WebDav Remote Shares
- MsBuild Making Network Connections
- Mshta Making Network Connections
- MsiExec Service Child Process With Network Connection
- Multi-Base64 Decoding Attempt from Suspicious Location
- Multi-Cloud CLI Token and Credential Access Commands
- Multiple Credential Access by VS Code or Cursor IDE Descendant
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- Namespace Manipulation Using Unshare
- NetSupport Manager Execution from an Unusual Path
- Netcat Listener Established via rlwrap
- Network Activity Detected via cat
- Network Connection Initiated by Suspicious SSHD Child Process
- Network Connection by Cups or Foomatic-rip Child
- Network Connection from Binary with RWX Memory Region
- Network Connection to OAST Domain via Script Interpreter
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Recently Compiled Executable
- Network Connection via Registration Utility
- Network Connection via Signed Binary
- Network Connections Initiated Through XDG Autostart Entry
- Network Traffic Capture via CAP_NET_RAW
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Newly Observed ScreenConnect Host Server
- Newly Seen Commonly Abused Network Scanner
- Node.js Pre or Post-Install Script Execution
- Nping Process Activity
- OpenSSL Password Hash Generation
- Openssl Client or Server Activity
- Parent Process PID Spoofing
- Passwordless Sudo Probing
- Payload Downloaded by Interpreter and Piped to Interpreter
- Pbpaste Execution via Unusual Parent Process
- Peripheral Device Discovery
- Perl Outbound Network Connection
- Persistence via BITS Job Notify Cmdline
- Persistence via Folder Action Script
- Persistence via Login or Logout Hook
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Pluggable Authentication Module (PAM) Source Download
- Pluggable Authentication Module (PAM) Version Discovery
- Pod or Container Creation with Suspicious Command-Line
- Polkit Version Discovery
- Potential Admin Group Account Addition
- Potential Application Shimming via Sdbinst
- Potential Backdoor Execution Through PAM_EXEC
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential CVE-2025-33053 Exploitation
- Potential Chroot Container Escape via Mount
- Potential Code Execution via Postgresql
- Potential Command Shell via NetCat
- Potential Command and Control via Internet Explorer
- Potential Container Escape via Kernel core_pattern Modification
- Potential Cookies Theft via Browser Debugging
- Potential Credential Access via Trusted Developer Utility
- Potential Credential Access via Windows Utilities
- Potential Credential Discovery via Recursive Grep
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Curl
- Potential Data Exfiltration Through Wget
- Potential Data Exfiltration via Rclone
- Potential Data Splitting Detected
- Potential Database Dumping Activity
- Potential Defense Evasion via CMSTP.exe
- Potential Defense Evasion via PRoot
- Potential Destructive AWS CLI Command Executed by GenAI Agent
- Potential Direct Kubelet Access via Process Arguments
- Potential Disabling of AppArmor
- Potential Disabling of SELinux
- Potential Docker Escape via Nsenter
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Escalation via Vulnerable MSI Repair
- Potential EtherHiding C2 via Curl JSON-RPC Request
- Potential Evasion via Filter Manager
- Potential Execution of rc.local Script
- Potential Execution via FileFix Phishing Attack
- Potential Execution via SSH Backdoor
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential Fileless Execution via O_TMPFILE
- Potential Fileless Execution via Unusual memfd Create Call
- Potential Foxmail Exploitation
- Potential Git CVE-2025-48384 Exploitation
- Potential Hex Payload Execution via Command-Line
- Potential Hex Payload Execution via Common Utility
- Potential Hidden Local User Account Creation
- Potential Hidden Process via Mount Hidepid
- Potential Impersonation Attempt via Kubectl
- Potential Java Service Exploitation via Suspicious Child Process
- Potential Kerberos Attack via Bifrost
- Potential Kubectl Masquerading via Unexpected Process
- Potential Kubeletctl Execution
- Potential Linux Backdoor User Account Creation
- Potential Linux Credential Dumping via Proc Filesystem
- Potential Linux Credential Dumping via Unshadow
- Potential Linux Hack Tool Launched
- Potential Linux Local Account Brute Force Detected
- Potential Linux Tunneling and/or Port Forwarding
- Potential Linux Tunneling and/or Port Forwarding via Command Line
- Potential Linux Tunneling and/or Port Forwarding via SSH Option
- Potential Local NTLM Relay via HTTP
- Potential Masquerading as Browser Process
- Potential Masquerading as Business App Installer
- Potential Masquerading as Communication Apps
- Potential Masquerading as Svchost
- Potential Masquerading as System32 Executable
- Potential Memory Seeking Activity
- Potential Modification of Accessibility Binaries
- Potential Network Scan Executed From Host
- Potential Notepad Markdown RCE Exploitation
- Potential Privacy Control Bypass via Localhost Secure Copy
- Potential Privacy Control Bypass via TCCDB Modification
- Potential Privilege Escalation through Writable Docker Socket
- Potential Privilege Escalation via CVE-2023-4911
- Potential Privilege Escalation via Container Misconfiguration
- Potential Privilege Escalation via Enlightenment
- Potential Privilege Escalation via InstallerFileTakeOver
- Potential Privilege Escalation via Linux DAC permissions
- Potential Privilege Escalation via Python cap_setuid
- Potential Privilege Escalation via Recently Compiled Executable
- Potential Privilege Escalation via SUID/SGID
- Potential Privilege Escalation via SUID/SGID Proxy Execution
- Potential Privilege Escalation via Sudoers File Modification
- Potential Privilege Escalation via a Parent Process Sequence
- Potential Privilege Escalation via a Parent/Child Process Sequence
- Potential Privilege Escalation via a Suspicious UID Change
- Potential Privilege Escalation via unshare and UID Change
- Potential Process Injection from Malicious Document
- Potential Prompt Injection Coercing Shell Execution
- Potential Protocol Tunneling via Chisel Client
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via EarthWorm
- Potential Protocol Tunneling via Yuze
- Potential Proxy Execution via Systemd-run
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote File Execution via MSIEXEC
- Potential Remote Install via MsiExec
- Potential Reverse Shell
- Potential Reverse Shell Activity via Terminal
- Potential Reverse Shell via Background Process
- Potential Reverse Shell via Child
- Potential Reverse Shell via Java
- Potential Reverse Shell via Suspicious Binary
- Potential Reverse Shell via Suspicious Child Process
- Potential SAP NetWeaver Exploitation
- Potential SSH Password Grabbing via strace
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Shadow File Read via Command Line Utilities