edr:other
Other EDR telemetry (Endgame, Carbon Black, product not stated)
- Host type
- EDR sensors (product telemetry, cross-platform)
- Techniques
- 0
- Rules listed
- 510
- Events
- 0
Techniques
No ATT&CK analytic names this source.
Rules
Elastic 503
- AWS CLI Command with Custom Endpoint URL
- AWS SSM `SendCommand` with Run Shell Command Parameters
- Abnormal Process ID or Lock File Created
- Access Control List Modification via setfacl
- Accessing Outlook Data Files
- Active Directory Discovery using AdExplorer
- AdFind Command Activity
- Adding Hidden File Attribute via Attrib
- Adversary Behavior - Detected - Elastic Endgame
- Alternate Data Stream Creation/Execution at Volume Root Directory
- AppArmor Profile Compilation via apparmor_parser
- At.exe Command Lateral Movement
- Attempt to Clear Kernel Ring Buffer
- Attempt to Clear Logs via Journalctl
- Attempt to Disable Auditd Service
- Attempt to Disable IPTables or Firewall
- Attempt to Disable Syslog Service
- Attempt to Establish VScode Remote Tunnel
- Attempt to Install or Run Kali Linux via WSL
- Attempted Private Key Access
- BPF Program Tampering via bpftool
- BPF Program or Map Load via bpftool
- BPF filter applied using TC
- Backup Deletion with Wbadmin
- Base16 or Base32 Encoding/Decoding Activity
- Binary Content Copy via Cmd.exe
- Binary Executed from Shared Memory Directory
- Bitsadmin Activity
- Browser Extension Install
- Browser Process Spawned from an Unusual Parent
- Bypass UAC via Event Viewer
- Chkconfig Service Add
- Clearing Windows Console History
- Clearing Windows Event Logs
- Code Signing Policy Modification Through Built-in tools
- Code Signing Policy Modification Through Registry
- Command Execution via ForFiles
- Command Execution via SolarWinds Process
- Command Obfuscation via Unicode Modifier Letters
- Command Shell Activity Started via RunDLL32
- Command and Scripting Interpreter via Windows Scripts
- Conhost Spawned By Suspicious Parent Process
- Connection to Common Large Language Model Endpoints
- Control Panel Process with Unusual Arguments
- Creation of Hidden Shared Object File
- Creation of SettingContent-ms Files
- Creation of a Hidden Local User Account
- Creation or Modification of Domain Backup DPAPI private key
- Creation or Modification of Root Certificate
- Creation or Modification of a new GPO Scheduled Task or Service
- Credential Access via TruffleHog Execution
- Credential Acquisition via Registry Hive Dumping
- Credential Dumping - Detected - Elastic Endgame
- Credential Dumping - Prevented - Elastic Endgame
- Credential Manipulation - Detected - Elastic Endgame
- Credential Manipulation - Prevented - Elastic Endgame
- Cupsd or Foomatic-rip Shell Execution
- Curl or Wget Spawned via Node.js
- D-Bus Service Created
- DNF Package Manager Plugin File Creation
- DNS Global Query Block List Modified or Disabled
- DNS-over-HTTPS Enabled via Registry
- Data Encrypted via OpenSSL Utility
- Delete Volume USN Journal with Fsutil
- Direct Process Execution via Background Utility
- Directory Creation in /bin directory
- Disable Windows Event and Security Logs Using Built-in Tools
- Disable Windows Firewall Rules via Netsh
- Disabling Lsa Protection via Registry Modification
- Disabling User Account Control via Registry Modification
- Disabling Windows Defender Security Settings via PowerShell
- Discovery of Domain Groups
- Docker Socket Enumeration
- Dracut Module Creation
- Dynamic Linker (ld.so) Creation
- ESXI Discovery via Find
- ESXI Discovery via Grep
- ESXI Timestomping using Touch Command
- Enable Host Network Discovery via Netsh
- Encrypting Files with WinRar or 7z
- Enumerating Domain Trusts via DSQUERY.EXE
- Enumerating Domain Trusts via NLTEST.EXE
- Enumeration Command Spawned via WMIPrvSE
- Enumeration of Administrator Accounts
- Executable Bit Set for Potential Persistence Script
- Executable File Creation with Multiple Extensions
- Executable Masquerading as Kernel Process
- Execution from Unusual Directory - Command Line
- Execution of COM object via Xwizard
- Execution of File Written or Modified by Microsoft Office
- Execution of Persistent Suspicious Program
- Execution via GitHub Actions Runner
- Execution via MSSQL xp_cmdshell Stored Procedure
- Execution via TSClient Mountpoint
- Execution via Windows Command Debugging Utility
- Execution via Windows Subsystem for Linux
- Execution via local SxS Shared Module
- Exploit - Detected - Elastic Endgame
- Exploit - Prevented - Elastic Endgame
- Exporting Exchange Mailbox via PowerShell
- File Creation in /var/log via Suspicious Process
- File Creation in World-Writable Directory by Unusual Process
- File Deletion via Shred
- File Staged in Root Folder of Recycle Bin
- File Transfer or Listener Established via Netcat
- File made Immutable by Chattr
- File with Right-to-Left Override Character (RTLO) Created/Executed
- First Time Seen Remote Monitoring and Management Tool
- First Time Seen Removable Device
- Full User-Mode Dumps Enabled System-Wide
- GRUB Configuration File Creation
- GRUB Configuration Generation through Built-in Utilities
- Git Hook Child Process
- Git Hook Created or Modified
- GitHub Authentication Token Access via Node.js
- Group Policy Discovery via Microsoft GPResult Utility
- Hidden Directory Creation via Unusual Parent
- Hidden Files and Directories via Hidden Flag
- High Number of Process Terminations
- High Number of Process and/or Service Terminations
- Host Detected with Suspicious Windows Process(es)
- Host File System Changes via Windows Subsystem for Linux
- Hping Process Activity
- IIS HTTP Logging Disabled
- IPv4/IPv6 Forwarding Activity
- Image File Execution Options Injection
- ImageLoad via Windows Update Auto Update Client
- Indirect Command Execution via Forfiles/Pcalua
- Initramfs Extraction via CPIO
- Initramfs Unpacking via unmkinitramfs
- InstallUtil Activity
- Installation of Custom Shim Databases
- Installation of Security Support Provider
- Interactive Terminal Spawned via Perl
- Interactive Terminal Spawned via Python
- KDE AutoStart Script or Desktop File Creation
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Removal
- Kirbi File Creation
- Kubectl Apply Pod from URL
- Kubectl Configuration Discovery
- Kubectl Network Configuration Modification
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubernetes Direct API Request via Curl or Wget
- LSASS Memory Dump Creation
- Lateral Movement via Startup Folder
- Linux Audio Recording Activity Detected
- Linux Clipboard Activity Detected
- Linux Firewall Rule Creation or Modification
- Linux Process Hooking via GDB
- Linux SSH X11 Forwarding
- Linux System Information Discovery
- Linux Telegram API Request
- Linux User Added to Privileged Group
- Linux Video Recording or Screenshot Activity Detected
- Linux init (PID 1) Secret Dump via GDB
- Local Account TokenFilter Policy Disabled
- MS Office Macro Security Registry Modifications
- Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score
- Malware - Detected - Elastic Endgame
- Malware - Prevented - Elastic Endgame
- Manual Dracut Execution
- Manual Memory Dumping via Proc Filesystem
- Manual Mount Discovery via /etc/exports or /etc/fstab
- Memory Swap Modification
- Microsoft Build Engine Started by a System Process
- Microsoft Build Engine Started by an Office Application
- Microsoft Build Engine Using an Alternate Name
- Microsoft Exchange Server UM Spawning Suspicious Processes
- Microsoft Exchange Server UM Writing Suspicious Files
- Microsoft Exchange Worker Spawning Suspicious Processes
- Microsoft IIS Connection Strings Decryption
- Microsoft IIS Service Account Password Dumped
- Microsoft Management Console File from Unusual Path
- Microsoft Windows Defender Tampering
- Mimikatz Memssp Log File Detected
- Modification of AmsiEnable Registry Key
- Modification of Boot Configuration
- Modification of Dynamic Linker Preload Shared Object
- Modification of WDigest Security Provider
- Mofcomp Activity
- Mounting Hidden or WebDav Remote Shares
- NTDS Dump via Wbadmin
- NTDS or SAM Database File Copied
- Namespace Manipulation Using Unshare
- NetSupport Manager Execution from an Unusual Path
- Netcat Listener Established via rlwrap
- Netsh Helper DLL
- Network Activity to a Suspicious Top Level Domain
- Network Connection via Certutil
- Network Logon Provider Registry Modification
- Network-Level Authentication (NLA) Disabled
- NetworkManager Dispatcher Script Creation
- New ActiveSyncAllowedDeviceID Added via PowerShell
- Nping Process Activity
- NullSessionPipe Registry Modification
- Office Test Registry Persistence
- OpenSSL Password Hash Generation
- Openssl Client or Server Activity
- Outlook Home Page Registry Modification
- Parent Process Detected with Suspicious Windows Process(es)
- Passwordless Sudo Probing
- Peripheral Device Discovery
- Permission Theft - Detected - Elastic Endgame
- Permission Theft - Prevented - Elastic Endgame
- Persistence via BITS Job Notify Cmdline
- Persistence via Hidden Run Key Detected
- Persistence via Microsoft Office AddIns
- Persistence via Microsoft Outlook VBA
- Persistence via PowerShell profile
- Persistence via Scheduled Job Creation
- Persistence via TelemetryController Scheduled Task Hijack
- Persistence via Update Orchestrator Service Hijack
- Persistence via WMI Event Subscription
- Persistence via WMI Standard Registry Provider
- Persistent Scripts in the Startup Directory
- Pluggable Authentication Module (PAM) Creation in Unusual Directory
- Pluggable Authentication Module (PAM) Source Download
- Pluggable Authentication Module (PAM) Version Discovery
- Pod or Container Creation with Suspicious Command-Line
- Polkit Policy Creation
- Polkit Version Discovery
- Port Forwarding Rule Addition
- Potential Application Shimming via Sdbinst
- Potential CVE-2025-32463 Nsswitch File Creation
- Potential CVE-2025-32463 Sudo Chroot Execution Attempt
- Potential CVE-2025-33053 Exploitation
- Potential Code Execution via Postgresql
- Potential Container Escape via Kernel core_pattern Modification
- Potential Credential Access via Windows Utilities
- Potential DLL Side-Loading via Trusted Microsoft Programs
- Potential DNS Tunneling via NsLookup
- Potential Data Exfiltration Through Wget
- Potential Data Exfiltration via Rclone
- Potential Data Splitting Detected
- Potential Database Dumping Activity
- Potential Defense Evasion via CMSTP.exe
- Potential Defense Evasion via Doas
- Potential Defense Evasion via PRoot
- Potential Disabling of AppArmor
- Potential Disabling of SELinux
- Potential EDR-Freeze via WerFaultSecure Abuse
- Potential Escalation via Vulnerable MSI Repair
- Potential Evasion via Filter Manager
- Potential Exploitation of an Unquoted Service Path Vulnerability
- Potential File Download via a Headless Browser
- Potential File Transfer via Certreq
- Potential File Transfer via Curl for Windows
- Potential Fileless Execution via O_TMPFILE
- Potential Foxmail Exploitation
- Potential Hex Payload Execution via Command-Line
- Potential Hex Payload Execution via Common Utility
- Potential Hidden Process via Mount Hidepid
- Potential IIS Web Shell File Creation
- Potential Impersonation Attempt via Kubectl
- Potential Kerberos SPN Spoofing via Suspicious DNS Query
- Potential Kubectl Masquerading via Unexpected Process
- Potential LSA Authentication Package Abuse
- Potential Linux Backdoor User Account Creation
- Potential Linux Credential Dumping via Proc Filesystem
- Potential Linux Credential Dumping via Unshadow
- Potential Linux Hack Tool Launched
- Potential Linux Tunneling and/or Port Forwarding
- Potential Linux Tunneling and/or Port Forwarding via Command Line
- Potential Linux Tunneling and/or Port Forwarding via SSH Option
- Potential Local NTLM Relay via HTTP
- Potential Masquerading as Business App Installer
- Potential Masquerading as Communication Apps
- Potential Modification of Accessibility Binaries
- Potential NetNTLMv1 Downgrade Attack
- Potential Network Scan Executed From Host
- Potential Notepad Markdown RCE Exploitation
- Potential OpenSSH Backdoor Logging Activity
- Potential Persistence via Time Provider Modification
- Potential Port Monitor or Print Processor Registration Abuse
- Potential Privilege Escalation via PKEXEC
- Potential Privilege Escalation via Service ImagePath Modification
- Potential Protocol Tunneling via Cloudflared
- Potential Protocol Tunneling via EarthWorm
- Potential Protocol Tunneling via Yuze
- Potential Proxy Execution via Systemd-run
- Potential REMCOS Trojan Execution
- Potential Remote Desktop Shadowing Activity
- Potential Remote Desktop Tunneling Detected
- Potential Remote Install via MsiExec
- Potential RemoteMonologue Attack
- Potential Reverse Shell via Background Process
- Potential SSH Reverse Port Forwarding
- Potential Secret Scanning via Gitleaks
- Potential Secure File Deletion via SDelete Utility
- Potential Shadow File Read via Command Line Utilities
- Potential Sudo Privilege Escalation via CVE-2019-14287
- Potential Suspicious File Edit
- Potential System Tampering via File Modification
- Potential THC Tool Downloaded
- Potential Telnet Authentication Bypass (CVE-2026-24061)
- Potential Traffic Tunneling using QEMU
- Potential Tunneling via Tailscaled
- Potential Unauthorized Access via Wildcard Injection Detected
- Potential Upgrade of Non-interactive Shell
- Potential Veeam Credential Access Command
- Potential WSUS Abuse for Lateral Movement
- Potential privilege escalation via CVE-2022-38028
- Potentially Suspicious Process Started via tmux or screen
- PowerShell Script Block Logging Disabled
- Printer User (lp) Shell Execution
- Private Key Searching Activity
- Privilege Escalation via Named Pipe Impersonation
- Privilege Escalation via Windir Environment Variable
- Privileged Container Creation with Host Directory Mount
- Privileged Docker Container Creation
- Process Activity via Compiled HTML File
- Process Backgrounded by Unusual Parent
- Process Capability Enumeration
- Process Capability Set via setcap Utility
- Process Discovery via Built-In Applications
- Process Execution from an Unusual Directory
- Process Injection - Detected - Elastic Endgame
- Process Injection - Prevented - Elastic Endgame
- Process Spawned from Message-of-the-Day (MOTD)
- Process Started from Process ID (PID) File
- Processes with Trailing Spaces
- Program Files Directory Masquerading
- Proxy Execution via Console Window Host
- Proxy Execution via Windows OpenSSH
- ProxyChains Activity
- RDP Enabled via Registry
- Ransomware - Detected - Elastic Endgame
- Ransomware - Prevented - Elastic Endgame
- Rapid7 Threat Command CVEs Correlation
- Rare SMB Connection to the Internet
- Registry Persistence via AppCert DLL
- Registry Persistence via AppInit DLL
- Remote Desktop Enabled in Windows Firewall by Netsh
- Remote Desktop File Opened from Suspicious Path
- Remote Execution via File Shares
- Remote File Copy to a Hidden Share
- Remote File Download via Desktopimgdownldr Utility
- Remote File Download via MpCmdRun
- Remote GitHub Actions Runner Registration
- Remote Management Access Launch After MSI Install
- Remote System Discovery Commands
- Renamed Automation Script Interpreter
- Renamed Utility Executed with Short Program Name
- Renaming of OpenSSH Binaries
- Root Certificate Installation
- SELinux Configuration Creation or Renaming
- SIP Provider Modification
- SSH Key Generated via ssh-keygen
- SSL Certificate Deletion
- Scheduled Task Created by a Windows Script
- Scheduled Tasks AT Command Enabled
- ScreenConnect Server Spawning Suspicious Processes
- Script Execution via Microsoft HTML Application
- Searching for Saved Credentials via VaultCmd
- Security File Access via Common Utilities
- Security Software Discovery using WMIC
- Sensitive Files Compression
- Service Control Spawned via Script Interpreter
- Service DACL Modification via sc.exe
- Service Disabled via Registry Modification
- Service Path Modification
- Service Path Modification via sc.exe
- Setcap setuid/setgid Capability Set
- Shared Object Created by Previously Unknown Process
- Shared Object Load via LoLBin
- Signed Proxy Execution via MS Work Folders
- Simple HTTP Web Server Creation
- SolarWinds Process Disabling Services via Registry
- Startup Persistence by a Suspicious Process
- Startup or Run Key Registry Modification
- Sudo Command Enumeration Detected
- Suspicious .NET Code Compilation
- Suspicious /proc/maps Discovery
- Suspicious Antimalware Scan Interface DLL
- Suspicious CertUtil Commands
- Suspicious Child Process of PaperCut Server Component
- Suspicious Cmd Execution via WMI
- Suspicious Communication App Child Process
- Suspicious Content Extracted or Decompressed via Funzip
- Suspicious Dynamic Linker Discovery via od
- Suspicious Endpoint Security Parent Process
- Suspicious Execution from Foomatic-rip or Cupsd Parent
- Suspicious Execution from INET Cache
- Suspicious Execution from a WebDav Share
- Suspicious Execution via Microsoft Office Add-Ins
- Suspicious Execution via Windows Subsystem for Linux
- Suspicious Execution with NodeJS
- Suspicious Explorer Child Process
- Suspicious File Creation via Kworker
- Suspicious Image Load (taskschd.dll) from MS Office
- Suspicious ImagePath Service Creation
- Suspicious Instance Metadata Service (IMDS) API Command Line Execution
- Suspicious JavaScript Execution via Deno
- Suspicious JetBrains TeamCity Child Process
- Suspicious Kworker UID Elevation
- Suspicious MS Office Child Process
- Suspicious MS Outlook Child Process
- Suspicious Managed Code Hosting Process
- Suspicious Memory grep Activity
- Suspicious Microsoft Antimalware Service Execution
- Suspicious Microsoft Diagnostics Wizard Execution
- Suspicious Microsoft HTML Application Child Process
- Suspicious Mining Process Creation Event
- Suspicious Network Activity to the Internet by Previously Unknown Executable
- Suspicious PDF Reader Child Process
- Suspicious Print Spooler File Deletion
- Suspicious Print Spooler Point and Print DLL
- Suspicious Process Execution via Renamed PsExec Executable
- Suspicious RDP ActiveX Client Loaded
- Suspicious Reading of procfs Syscall File
- Suspicious ScreenConnect Client Child Process
- Suspicious Script Object Execution
- Suspicious Shell Execution via Velociraptor
- Suspicious SolarWinds Child Process
- Suspicious Startup Shell Folder Modification
- Suspicious System Commands Executed by Previously Unknown Executable
- Suspicious Termination of ESXI Process
- Suspicious Troubleshooting Pack Cabinet Execution
- Suspicious Utility Launched via ProxyChains
- Suspicious WMI Image Load from MS Office
- Suspicious WerFault Child Process
- Suspicious Windows Command Shell Arguments
- Suspicious Windows Powershell Arguments
- Suspicious Write Attempt to AppArmor Policy Management Files
- Suspicious Zoom Child Process
- Suspicious which Enumeration
- Svchost spawning Cmd
- Symbolic Link to Shadow Copy Created
- System File Ownership Change
- System Hosts File Access
- System Information Discovery via Windows Command Shell
- System Information Discovery via dmidecode from Parent Shell
- System Log File Deletion
- System Owner/User Discovery Linux
- System Public IP Discovery via DNS Query
- System Service Discovery through built-in Windows Utilities
- System Shells via Services
- System Time Discovery
- System V Init Script Created
- Tampering of Shell Command-Line History
- Threat Intel Hash Indicator Match
- Threat Intel IP Address Indicator Match
- Threat Intel URL Indicator Match
- Threat Intel Windows Registry Indicator Match
- Trap Signals Execution
- UAC Bypass Attempt via Elevated COM Internet Explorer Add-On Installer
- UAC Bypass Attempt via Privileged IFileOperation COM Interface
- UAC Bypass Attempt via Windows Directory Masquerading
- UAC Bypass Attempt with IEditionUpgradeManager Elevated COM Interface
- UAC Bypass via DiskCleanup Scheduled Task Hijack
- UAC Bypass via ICMLuaUtil Elevated COM Interface
- UAC Bypass via Windows Firewall Snap-In Hijack
- Unix Socket Connection
- Unusual Child Process from a System Virtual Process
- Unusual Child Process of dns.exe
- Unusual D-Bus Daemon Child Process
- Unusual Executable File Creation by a System Critical Process
- Unusual Execution via Microsoft Common Console File
- Unusual File Creation - Alternate Data Stream
- Unusual File Operation by dns.exe
- Unusual Parent Process for cmd.exe
- Unusual Parent-Child Relationship
- Unusual Persistence via Services Registry
- Unusual Pkexec Execution
- Unusual Print Spooler Child Process
- Unusual Process Execution Path - Alternate Data Stream
- Unusual Process Execution on WBEM Path
- Unusual Process Spawned by a Host
- Unusual Process Spawned by a Parent Process
- Unusual Process Spawned by a User
- Unusual Service Host Child Process - Childless Service
- User Account Creation
- User Detected with Suspicious Windows Process(es)
- Virtual Machine Fingerprinting
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Volume Shadow Copy Deletion via PowerShell
- Volume Shadow Copy Deletion via WMIC
- WDAC Policy File by an Unusual Process
- WMI WBEMTEST Utility Execution
- WMIC Remote Command
- Web Server Spawned via Python
- Web Shell Detection: Script Process Child of Common Web Processes
- Werfault ReflectDebugger Persistence
- Whoami Process Activity
- Windows Defender Disabled via Registry Modification
- Windows Defender Exclusions Added via PowerShell
- Windows Firewall Disabled via PowerShell
- Windows Network Enumeration
- Windows Sandbox with Sensitive Configuration
- Windows Script Executing PowerShell
- Windows Script Execution from Archive
- Windows Script Interpreter Executing Process via WMI
- Windows Server Update Service Spawning Suspicious Processes
- Windows Subsystem for Linux Distribution Installed
- Windows Subsystem for Linux Enabled via Dism Utility
- Windows System Information Discovery
- Wireless Credential Dumping using Netsh Command
- XDG-Open Command Execution
- Yum/DNF Plugin Status Discovery
Microsoft Sentinel 7
- Detect Malicious Usage of Recovery Tools to Delete Backup Files
- Detect Print Processors Registry Driver Key Creation/Modification
- Detect Registry Run Key Creation/Modification
- Detect Windows Allow Firewall Rule Addition/Modification
- Detect Windows Update Disabled from Registry
- Known Malware Detected
- Process Creation with Suspicious CommandLine Arguments
Events
No event-level rows: this source is tiered as a whole.