edr:elastic-defend
Elastic Defend endpoint events
logs-endpoint.events.<dataset>; keys are the dataset (process, network, file, registry, library, security)
- Host type
- EDR sensors (product telemetry, cross-platform)
- Tier, as a whole
- Recommended
- Cost class
- Free tool
- Techniques
- 0
- Rules listed
- 600 of 1,081
- Events
- 8
Licensing
- License or service
- Elastic Agent with the Elastic Defend integration
- What is free
- Elastic Defend is available under the free Basic license; datasets logs-endpoint.events.*
- What costs
- Advanced protections and some response features need Platinum or Enterprise; storage of the events in Elasticsearch is the customer's cost
- Notes
- Elastic's own EDR; most Elastic prebuilt Windows rules target these datasets
- Vendor page
- https://www.elastic.co/subscriptions
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Techniques
No ATT&CK analytic names this source.
Rules
600 of 1,081 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Elastic 600
- APT Package Manager Configuration File Creation
- AWS Audit or Security Service Tampering via CLI
- AWS CLI Command with Custom Endpoint URL
- AWS CLI Configuration Modified by Unusual Process
- AWS Control Plane Access by Suspicious Process
- AWS Credentials Searched For Inside A Container
- AWS EC2 LOLBin Execution via SSM SendCommand
- AWS SSM Agent Registered via Hybrid Activation
- AWS SSM Session Manager Child Process Execution
- AWS SSM `SendCommand` with Run Shell Command Parameters
- Abnormal Process ID or Lock File Created
- Access Control List Modification via setfacl
- Accessing Outlook Data Files
- Account Discovery Command via SYSTEM Account
- Account or Group Discovery via Built-In Tools
- Active Directory Discovery using AdExplorer
- Active Directory Forced Authentication from Linux Host - SMB Named Pipes
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Agent Spoofing - Multiple Hosts Using Same Agent
- Alternate Data Stream Creation/Execution at Volume Root Directory
- Anomalous Linux Compiler Activity
- Anomalous Process For a Linux Population
- Anomalous Process For a Windows Population
- Anomalous Windows Process Creation
- AppArmor Profile Compilation via apparmor_parser
- Apple Script Execution followed by Network Connection
- Apple Scripting Execution with Administrator Privileges
- Archive File with Unusual Extension
- At Job Created or Modified
- At.exe Command Lateral Movement
- Attempt to Clear Kernel Ring Buffer
- Attempt to Clear Logs via Journalctl
- Attempt to Disable Auditd Service
- Attempt to Disable Gatekeeper
- Attempt to Disable IPTables or Firewall
- Attempt to Disable Syslog Service
- Attempt to Enable the Root Account
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install Root Certificate
- Attempt to Install or Run Kali Linux via WSL
- Attempt to Mount SMB Share via Command Line
- Attempt to Unload Elastic Endpoint Security Kernel Extension
- Attempted Private Key Access
- Authorization Plugin Modification
- AzCopy or Azure Storage Explorer Usage on Unusual Host
- Azure Run Command Correlated with Process Execution
- Azure Run Command Script Child Process
- Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation
- Azure WireServer Unusual Process Connection
- BPF Program Tampering via bpftool
- BPF Program or Map Load via bpftool
- BPF filter applied using TC
- Backup Deletion with Wbadmin
- Base16 or Base32 Encoding/Decoding Activity
- Base64 Decoded Payload Piped to Interpreter
- Bash Shell Profile Modification
- Behavior - Detected - Elastic Defend
- Behavior - Prevented - Elastic Defend
- Binary Content Copy via Cmd.exe
- Binary Executed from Shared Memory Directory
- Binfmt Configuration File Creation
- Bitsadmin Activity
- Boot File Copy
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Chkconfig Service Add
- Chroot Execution in Container Context on Linux
- Claude Cowork VM Boot Image Tamper
- Clearing Windows Console History
- Clearing Windows Event Logs
- Cloud Offensive Framework Execution
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Component Object Model Hijacking
- Compression DLL Loaded by Unusual Process
- Conhost Spawned By Suspicious Parent Process
- Connection to Common Large Language Model Endpoints
- Connection to Commonly Abused Free SSL Certificate Providers
- Connection to Commonly Abused Web Services
- Connection to External Network via Telnet
- Connection to Internal Network via Telnet
- Container Management Utility Run Inside A Container
- Container Runtime CLI Execution with Suspicious Arguments
- Control Panel Process with Unusual Arguments
- Creation of Hidden Files and Directories via CommandLine
- Creation of Hidden Launch Agent or Daemon
- Creation of Hidden Login Item via Apple Script
- Creation of Hidden Shared Object File
- Creation of SettingContent-ms Files
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Cron Job Created or Modified
- Cupsd or Foomatic-rip Shell Execution
- Curl Download Activity from npm Package Install
- Curl Execution via Shell Profile
- Curl SOCKS Proxy Activity from Unusual Parent
- Curl or Wget Egress Network Connection via LoLBin
- Curl or Wget Spawned via Node.js
- D-Bus Service Created
- DNF Package Manager Plugin File Creation
- DNS Global Query Block List Modified or Disabled
- DNS Request for IP Lookup Service via Unsigned Binary
- DNS Tunneling
- DNS to Commonly Abused Web Services
- DNS-over-HTTPS Enabled via Registry
- DPKG Package Installed by Unusual Parent Process
- Data Encrypted via OpenSSL Utility
- Decline in host-based traffic
- Delayed Execution via Ping
- Delete Volume USN Journal with Fsutil
- Direct Process Execution via Background Utility
- Directory Creation in /bin directory
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Discovery Command Output Written to Suspicious File
- Discovery of Domain Groups
- Discovery of Internet Capabilities via Built-in Tools
- Docker Release File Creation
- Docker Socket Enumeration
- Downloaded Shortcut Files
- Downloaded URL Files
- Dracut Module Creation
- Dumping Account Hashes via Built-In Commands
- Dumping of Keychain Content via Security Command
- Dylib Injection via Process Environment Variables
- Dynamic Linker (ld.so) Creation
- Dynamic Linker Copy
- Dynamic Linker Creation
- ELF Binary Created in System Directory by Suspicious Process
- ELF Payload Staged in a Suspicious Directory
- ESXI Discovery via Find
- ESXI Discovery via Grep
- ESXI Timestomping using Touch Command
- Egress Connection from Entrypoint in Container
- Elastic Agent Service Terminated
- Elastic Defend Alert Followed by Telemetry Loss
- Elastic Defend Alert from GenAI Utility or Descendant
- Elastic Defend Alert from Package Manager Install Ancestry
- Elastic Defend and Email Alerts Correlation
- Elastic Defend and Network Security Alerts Correlation
- Emond Rules Creation or Modification
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Endpoint Security (Elastic Defend)
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Enumeration of Users or Groups via Built-in Commands
- Executable Bit Set for Potential Persistence Script
- Executable File Creation with Multiple Extensions
- Executable File Download via Wget
- Executable File with Unusual Extension
- Executable Masquerading as Kernel Process
- Execution from Unusual Directory - Command Line
- Execution from a Removable Media with Network Connection
- Execution of COM object via Xwizard
- Execution of File Written or Modified by Microsoft Office
- Execution of Persistent Suspicious Program
- Execution of a Downloaded Windows Script
- Execution of an Unsigned Service
- Execution via Electron Child Process Node.js Module
- Execution via GitHub Actions Runner
- Execution via MS VisualStudio Pre/Post Build Events
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via Microsoft DotNet ClickOnce Host
- Execution via OpenClaw Agent
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Execution with Explicit Credentials via Scripting
- Expired or Revoked Driver Loaded
- Exporting Exchange Mailbox via PowerShell
- External IP Address Discovery via Curl
- External IP Lookup from Non-Browser Process
- File Compressed or Archived into Common Format by Unsigned Process
- File Creation by Cups or Foomatic-rip Child
- File Creation in /var/log via Suspicious Process
- File Creation in World-Writable Directory by Unusual Process
- File Creation, Execution and Self-Deletion in Suspicious Directory
- File Deletion via Shred
- File Downloaded by Curl/Wget and Piped to Interpreter
- File Permission Modification in Writable Directory
- File Staged in Root Folder of Recycle Bin
- File System Debugger Launched Inside a Container
- File Transfer Utility Launched from Unusual Parent
- File Transfer or Listener Established via Netcat
- File and Directory Permissions Modification
- File made Immutable by Chattr
- File or Directory Deletion Command
- File with High Entropy Created by Web Server
- File with Right-to-Left Override Character (RTLO) Created/Executed
- File with Suspicious Double Extension Created by Web Server
- File with Suspicious Extension Downloaded
- Finder Sync Plugin Registered and Enabled
- First Time Python Accessed Sensitive Credential Files
- First Time Python Created a LaunchAgent or LaunchDaemon
- First Time Python Spawned a Shell on Host
- First Time Seen DNS Query to RMM Domain
- First Time Seen Driver Loaded
- First Time Seen RMM Signer Across the Environment
- First Time Seen Remote Monitoring and Management Tool
- First Time Seen Removable Device
- FortiGate SOCKS Traffic from an Unusual Process
- Full Disk Access Permission Check
- Full User-Mode Dumps Enabled System-Wide
- GRUB Configuration File Creation
- GRUB Configuration Generation through Built-in Utilities
- Gatekeeper Override and Execution
- GenAI Agent Instruction File Written to Downloads
- GenAI CLI Started with Unsafe Permission Bypass
- GenAI Process Accessing Sensitive Files
- GenAI Process Compiling or Generating Executables
- GenAI Process Connection to Suspicious Top Level Domain
- GenAI Process Connection to Unusual Domain
- GenAI Process Performing Encoding/Chunking Prior to Network Activity
- GenAI or MCP Server Child Process Execution
- Git Hook Child Process
- Git Hook Command Execution
- Git Hook Created or Modified
- Git Hook Egress Network Connection
- Git Repository or File Download to Suspicious Directory
- GitHub Authentication Token Access via Node.js
- Google Calendar C2 via Script Interpreter
- Group Policy Discovery via Microsoft GPResult Utility
- Hidden Directory Creation via Unusual Parent
- Hidden File Created in System Directory by Suspicious Process
- Hidden Files and Directories via Hidden Flag
- High Command Line Entropy Detected for Privileged Commands
- High Mean of Process Arguments in an RDP Session
- High Mean of RDP Session Duration
- High Number of Egress Network Connections from Unusual Executable
- High Number of Process Terminations
- High Number of Process and/or Service Terminations
- High Variance in RDP Session Duration
- Host Detected with Suspicious Windows Process(es)
- Host File System Changes via Windows Subsystem for Linux
- Hosts File Modified
- Hping Process Activity
- IIS HTTP Logging Disabled
- IPv4/IPv6 Forwarding Activity
- Image File Execution Options Injection
- Image Loaded with Invalid Signature
- ImageLoad via Windows Update Auto Update Client
- Incoming DCOM Lateral Movement via MSHTA
- Incoming DCOM Lateral Movement with MMC
- Incoming DCOM Lateral Movement with ShellBrowserWindow or ShellWindows
- Incoming Execution via PowerShell Remoting
- Incoming Execution via WinRM Remote Shell
- Indirect Command Execution via Forfiles/Pcalua
- Ingress Transfer via Windows BITS
- Initial Access via File Upload Followed by GET Request
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- InstallUtil Activity
- InstallUtil Process Making Network Connections
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Interactive Shell Launched via Unusual Parent Process in a Container
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python
- Java Dropped and Executed With DNS Lookup
- KDE AutoStart Script or Desktop File Creation
- Kerberos Cached Credentials Dumping
- Kerberos Traffic from Unusual Process
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Load from Unusual Location
- Kernel Module Load via Built-in Utility
- Kernel Module Loaded with Tainting Flags
- Kernel Module Removal
- Kernel Object File Creation
- Kernel Seeking Activity
- Kernel Unpacking Activity
- Keychain CommandLine Interaction via Unsigned or Untrusted Process
- Keychain Password Retrieval via Command Line
- Kill Command Execution
- Kirbi File Creation
- Kubeconfig File Creation or Modification
- Kubeconfig File Discovery
- Kubectl Apply Pod from URL
- Kubectl Configuration Discovery
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubelet API Connection Attempt to Internal IP
- Kubernetes Direct API Request via Curl or Wget
- Kubernetes Sensitive Configuration File Activity
- Kubernetes Service Account Secret Access
- Kubernetes Static Pod Manifest File Access
- Kubernetes and Cloud Credential Path Access via Process Arguments
- LLM-Based Attack Chain Triage by Host
- LLM-Based Curl Activity Triage
- LLM-Based Wget Activity Triage
- LSASS Memory Dump Creation
- LSASS Process Access via Windows API
- Lateral Movement via Startup Folder
- Launch Service Creation and Immediate Loading
- Linux Audio Recording Activity Detected
- Linux Clipboard Activity Detected
- Linux External IP Address Discovery via Curl
- Linux Firewall Rule Creation or Modification
- Linux Process Hooking via GDB
- Linux SSH X11 Forwarding
- Linux System Information Discovery
- Linux System Information Discovery via Getconf
- Linux Telegram API Request
- Linux User Account Credential Modification
- Linux User Added to Privileged Group
- Linux Video Recording or Screenshot Activity Detected
- Linux init (PID 1) Secret Dump via GDB
- Loadable Kernel Module Configuration File Creation
- Local Account TokenFilter Policy Disabled
- Local Scheduled Task Creation
- Long Base64 Encoded Command via Scripting Interpreter
- Lure-Themed Internet-Delivered RMM Executable
- Machine Learning Detected DGA activity using a known SUNBURST DNS domain
- Machine Learning Detected a DNS Request Predicted to be a DGA Domain
- Machine Learning Detected a DNS Request With a High DGA Probability Score
- Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
- Malicious File - Detected - Elastic Defend
- Malicious File - Prevented - Elastic Defend
- Manual Dracut Execution
- Manual Loading of a Suspicious Chromium Extension
- Manual Memory Dumping via Proc Filesystem
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Mark-of-the-Web Removal by an Unusual Process
- Masquerading Space After Filename
- Memory Dump File with Unusual Extension
- Memory Swap Modification
- Memory Threat - Detected - Elastic Defend
- Memory Threat - Prevented- Elastic Defend
- Message-of-the-Day (MOTD) File Creation
- Microsoft Build Engine Started an Unusual Process
- Microsoft Build Engine Started by a Script Process
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Modification of Dynamic Linker Preload Shared Object
- Modification of Environment Variable via Unsigned or Untrusted Parent
- Modification of Safari Settings via Defaults Command
- Modification of WDigest Security Provider
- Mofcomp Activity
- Mount Launched Inside a Container
- Mounting Hidden or WebDav Remote Shares
- MsBuild Making Network Connections
- Mshta Making Network Connections
- MsiExec Service Child Process With Network Connection
- Multi-Base64 Decoding Attempt from Suspicious Location
- Multi-Cloud CLI Token and Credential Access Commands
- Multiple Credential Access by VS Code or Cursor IDE Descendant
- Multiple Elastic Defend Alerts by Agent
- Multiple Elastic Defend Alerts from a Single Process Tree
- Multiple Rare Elastic Defend Behavior Rules by Host
- Multiple Remote Management Tool Vendors on Same Host
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- Namespace Manipulation Using Unshare
- NetSupport Manager Execution from an Unusual Path
- Netcat Listener Established via rlwrap
- Netsh Helper DLL
- Network Activity Detected via Kworker
- Network Activity Detected via cat
- Network Activity to a Suspicious Top Level Domain
- Network Connection Followed by File Creation
- Network Connection Initiated by Suspicious SSHD Child Process
- Network Connection by Cups or Foomatic-rip Child
- Network Connection from Binary with RWX Memory Region
- Network Connection to OAST Domain via Script Interpreter
- Network Connection via Certutil
- Network Connection via Compiled HTML File
- Network Connection via MsXsl
- Network Connection via Recently Compiled Executable
- Network Connection via Registration Utility
- Network Connection via Signed Binary
- Network Connections Initiated Through XDG Autostart Entry
- Network Logon Provider Registry Modification
- Network Traffic Capture via CAP_NET_RAW
- Network Traffic to Rare Destination Country
- Network-Level Authentication (NLA) Disabled
- NetworkManager Dispatcher Script Creation
- New ActiveSyncAllowedDeviceID Added via PowerShell
- New USB Storage Device Mounted
- Newly Observed Elastic Defend Behavior Alert
- Newly Observed ScreenConnect Host Server
- Newly Seen Commonly Abused Network Scanner
- Node.js Pre or Post-Install Script Execution
- Nping Process Activity
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- Ollama API Accessed from External Network
- Ollama DNS Query to Untrusted Domain
- OpenSSL Password Hash Generation
- Openssl Client or Server Activity
- Outbound Scheduled Task Activity via PowerShell
- Outlook Home Page Registry Modification
- PANW and Elastic Defend - Command and Control Correlation
- PHP File Creation in WordPress Plugin Directory
- Package Runtime Secret File Access Followed by IMDS Request
- Parent Process Detected with Suspicious Windows Process(es)
- Parent Process PID Spoofing
- Passwordless Sudo Probing
- Payload Downloaded by Interpreter and Piped to Interpreter
- Pbpaste Execution via Unusual Parent Process
- Peripheral Device Discovery
- Perl Outbound Network Connection
- Persistence via BITS Job Notify Cmdline
- Persistence via DirectoryService Plugin Modification
- Persistence via Docker Shortcut Modification
- Persistence via Folder Action Script
- Persistence via Hidden Run Key Detected
- Persistence via Login or Logout Hook
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via Suspicious Launch Agent or Launch Daemon
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistence via WMI Standard Registry Provider
- Persistence via a Hidden Plist Filename
- Persistence via a Windows Installer
- Persistent Scripts in the Startup Directory
- Pluggable Authentication Module (PAM) Creation in Unusual Directory
- Pluggable Authentication Module (PAM) Source Download
- Pluggable Authentication Module (PAM) Version Discovery
- Pluggable Authentication Module or Configuration Creation
- Pod or Container Creation with Suspicious Command-Line
- Polkit Policy Creation
- Polkit Version Discovery
- Port Forwarding Rule Addition
- Potential Admin Group Account Addition
- Potential Application Shimming via Sdbinst
- Potential Backdoor Execution Through PAM_EXEC
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential CVE-2025-33053 Exploitation
- Potential Chroot Container Escape via Mount
- Potential ClickFix Command via Windows Run Dialog
- Potential Code Execution via Postgresql
- Potential Command Shell via NetCat
- Potential Command and Control via Internet Explorer
- Potential Container Escape via Kernel core_pattern Modification
- Potential Cookies Theft via Browser Debugging
- Potential Credential Access via Memory Dump File Creation
- Potential Credential Access via Trusted Developer Utility
- Potential Credential Access via Windows Utilities
- Potential Credential Discovery via Recursive Grep
- Potential DGA Activity
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Exfiltration via Excessive Chunked Queries
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Activity to an Unusual Destination Port
- Potential Data Exfiltration Activity to an Unusual IP Address
- Potential Data Exfiltration Activity to an Unusual ISO Code
- Potential Data Exfiltration Activity to an Unusual Region
- Potential Data Exfiltration Through Curl
- Potential Data Exfiltration Through Wget
- Potential Data Exfiltration via Rclone
- Potential Data Splitting Detected
- Potential Database Dumping Activity
- Potential Defense Evasion via CMSTP.exe
- Potential Defense Evasion via Doas
- Potential Defense Evasion via PRoot
- Potential Destructive AWS CLI Command Executed by GenAI Agent
- Potential Direct Kubelet Access via Process Arguments
- Potential Disabling of AppArmor
- Potential Disabling of SELinux
- Potential Docker Escape via Nsenter
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Entra ID PRT Extraction via BrowserCore
- Potential Enumeration via Active Directory Web Service
- Potential Escalation via Vulnerable MSI Repair
- Potential EtherHiding C2 via Curl JSON-RPC Request
- Potential Etherhiding C2 via Blockchain Connection
- Potential Evasion via Boot Time Removal Tool
- Potential Evasion via Filter Manager
- Potential Execution of rc.local Script
- Potential Execution via FileFix Phishing Attack
- Potential Execution via SSH Backdoor
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential Fake CAPTCHA Phishing Attack
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential FileFix Command via Windows Explorer Address Bar
- Potential Fileless Execution via O_TMPFILE
- Potential Fileless Execution via Unusual memfd Create Call
- Potential Foxmail Exploitation
- Potential Git CVE-2025-48384 Exploitation
- Potential Hex Payload Execution via Command-Line
- Potential Hex Payload Execution via Common Utility
- Potential Hidden Local User Account Creation
- Potential Hidden Process via Mount Hidepid
- Potential IIS Web Shell File Creation
- Potential Impersonation Attempt via Kubectl
- Potential Java Service Exploitation via Suspicious Child Process
- Potential Kerberos Attack via Bifrost
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential Kubectl Masquerading via Unexpected Process
- Potential Kubeletctl Execution
- Potential LSA Authentication Package Abuse
- Potential Lateral Tool Transfer via SMB Share
- Potential Linux Backdoor User Account Creation
- Potential Linux Credential Dumping via Proc Filesystem
- Potential Linux Credential Dumping via Unshadow
- Potential Linux Hack Tool Launched
- Potential Linux Local Account Brute Force Detected
- Potential Linux Ransomware Note Creation Detected
- Potential Linux Tunneling and/or Port Forwarding
- Potential Linux Tunneling and/or Port Forwarding via Command Line
- Potential Linux Tunneling and/or Port Forwarding via SSH Option
- Potential Local NTLM Relay via HTTP
- Potential Malware-Driven SSH Brute Force Attempt
- Potential Masquerading as Browser Process
- Potential Masquerading as Business App Installer
- Potential Masquerading as Communication Apps
- Potential Masquerading as Svchost
- Potential Masquerading as System32 DLL
- Potential Masquerading as System32 Executable
- Potential Masquerading as VLC DLL
- Potential Memory Seeking Activity
- Potential Microsoft Office Sandbox Evasion
- Potential Modification of Accessibility Binaries
- Potential NetNTLMv1 Downgrade Attack
- Potential Network Scan Executed From Host
- Potential Notepad Markdown RCE Exploitation
- Potential OpenSSH Backdoor Logging Activity
- Potential Outgoing RDP Connection by Unusual Process
- Potential Persistence via Atom Init Script Modification
- Potential Persistence via Login Hook
- Potential Persistence via Mandatory User Profile
- Potential Persistence via Periodic Tasks
- Potential Persistence via Time Provider Modification
- Potential Polyglot Bypass File Created by Web Server
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Port Scanning Activity from Compromised Host
- Potential Privacy Control Bypass via Localhost Secure Copy
- Potential Privacy Control Bypass via TCCDB Modification
- Potential Privilege Escalation through Writable Docker Socket
- Potential Privilege Escalation via CVE-2023-4911
- Potential Privilege Escalation via Container Misconfiguration
- Potential Privilege Escalation via Enlightenment
- Potential Privilege Escalation via InstallerFileTakeOver
- Potential Privilege Escalation via Linux DAC permissions
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Python cap_setuid
- Potential Privilege Escalation via Recently Compiled Executable
- Potential Privilege Escalation via SUID/SGID
- Potential Privilege Escalation via SUID/SGID Proxy Execution
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Privilege Escalation via Sudoers File Modification
- Potential Privilege Escalation via a Parent Process Sequence
- Potential Privilege Escalation via a Parent/Child Process Sequence
- Potential Privilege Escalation via a Suspicious UID Change
- Potential Privilege Escalation via unshare and UID Change
- Potential Process Injection from Malicious Document
- Potential Prompt Injection Coercing Shell Execution
- Potential Protocol Tunneling via Chisel Client
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via EarthWorm
- Potential Protocol Tunneling via Yuze
- Potential Proxy Execution via Systemd-run
- Potential REMCOS Trojan Execution
- Potential RMM Execution from a Commonly Abused Web Service
- Potential Ransomware Behavior - Note Files by System
- Potential Ransomware Note File Dropped via SMB
- Potential Remote Credential Access via Registry
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote File Execution via MSIEXEC
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential Reverse Shell