Privilege Escalation: Cisco Tetration (Secure Workload) detects privilege escalation by monitoring the process lineage tree. It looks for anomalies where a child process gains higher privileges (e.g., root) than its parent in an unauthorized or unexpected manner.

User Login Suspicious Behavior: This pattern focuses on authentication security. The platform monitors logs to detect access failures (brute force attempts) and unusual access methods (e.g., root login attempts over SSH).

Interesting File Access: In Tetration terminology, "interesting files" are user-defined sensitive files (e.g., /etc/shadow, private keys). The platform is "armed" to trigger alerts whenever these specific files are accessed.

File Access from a Different User: This detection relies on behavioral analysis. The platform learns the normal behavior (baseline) of which users typically run specific processes or access files. If a different user than the baseline performs the action, it is flagged.

Cisco Systems. Cisco Secure Workload (formerly Tetration) Workload Protection User Guide. "Forensics and Analysis" section. (Confirms the definition of Interesting File Access as monitoring sensitive files and the use of process lineage for privilege escalation detection).

Cisco Systems. Cisco Tetration Analytics Data Sheet. Section: "Software Vulnerability and Exposure Detection". (Describes the platform's capability to learn normal behavior patterns to detect anomalies like unexpected user access).

Cisco Live. BRKSEC-2046 - Cisco Tetration Analytics: Deep Dive. Slide deck, "Behavioral Analysis and Forensics". (Illustrates how process lineage is used to track privilege changes and how user login failures are monitored).