Skip to content
Threat Feed
Subscribe

Tag

Auditd-Manager

4 briefs RSS
low advisory

Unusual Linux Process Discovery Activity

An Elastic machine learning rule detects unusual Linux process discovery activity from atypical user contexts, indicating a potentially compromised account performing reconnaissance for privilege escalation or persistence on Linux systems.

endpoint linux elastic-defend auditd-manager threat-detection ml machine-learning discovery +1
1t
low advisory

Unusual Linux System Information Discovery Activity Detection

Elastic has developed a machine learning detection rule to identify unusual user command activity related to system information discovery on Linux systems, indicating potential post-compromise reconnaissance for privilege escalation or persistence.

endpoint linux elastic-defend auditd-manager threat-detection machine-learning discovery
1t
low advisory

Unusual Process Writing Data to an External Device Detected by Machine Learning

Elastic's Data Exfiltration Detection integration leverages machine learning to identify rare processes writing data to external devices, indicating potential data exfiltration by adversaries using benign-looking processes.

Elastic Defend +15 exfiltration machine-learning elastic-defend endpoint lateral-movement rdp anomaly-detection privilege-escalation +29
22t
medium advisory

LLM-Based Detection of Suspicious Curl Activity on Linux

Elastic's LLM-based detection rule identifies suspicious `curl` activity on Linux systems, aiming to detect command and control, data exfiltration, or ingress tool transfer by analyzing command-line parameters and network destinations via Auditd Manager or Auditbeat logs, which, if left unaddressed, could lead to system compromise or data breach.

Azure +3 Endpoint LLM Linux Threat Detection Collection Command and Control Exfiltration Auditd Manager
3t updated