ESF write

Elastic (17)

• Authorization Plugin Modification severity medium T1547, T1547.002, T1556
• Discovery Command Output Written to Suspicious File severity medium T1016, T1033, T1074, T1074.001, T1082
• Emond Rules Creation or Modification severity medium T1546, T1546.014
• Executable File Download via Wget severity medium T1105, T1204, T1204.002
• GenAI Process Accessing Sensitive Files severity high T1005, T1037, T1037.004, T1552, T1552.001, T1555
• Persistence via DirectoryService Plugin Modification severity medium T1547, T1574
• Persistence via Docker Shortcut Modification severity medium T1543, T1547, T1547.009
• Potential Etherhiding C2 via Blockchain Connection severity high T1059, T1059.002, T1059.004, T1059.006, T1059.007, T1102
• Potential Microsoft Office Sandbox Evasion severity high T1036, T1036.005, T1497
• Potential Persistence via Atom Init Script Modification severity low T1037, T1546
• Potential Persistence via Periodic Tasks severity low T1053, T1053.003
• Privilege Escalation via Root Crontab File Modification severity high T1053, T1053.003
• Screensaver Plist File Modified by Unexpected Process severity medium T1546, T1546.002
• Sensitive File Access followed by Compression severity high T1005, T1074, T1074.001, T1560
• Sublime Plugin or Application Script Modification severity low T1554
• Suspicious Calendar File Modification severity medium T1546
• Unusual Process Modifying GenAI Configuration File severity medium T1546, T1554, T1556, T1574