| elastic |
AdFind Command Activity |
production |
2026-10-06 |
| splunk |
MacOS List Firewall Rules |
production |
2026-10-02 |
| splunk |
Linux System Network Discovery |
production |
2026-10-02 |
| splunk |
Linux Auditd System Network Configuration Discovery |
production |
2026-10-02 |
| splunk |
Cisco NVM - Suspicious Network Connection to IP Lookup Service API |
production |
2026-09-22 |
| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| elastic |
DNS Enumeration Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Linux External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
Potential Meterpreter Reverse Shell |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Discovery Command Output Written to Suspicious File |
production |
2026-09-18 |
| elastic |
DNS Request for IP Lookup Service via Unsigned Binary |
production |
2026-09-18 |
| elastic |
External IP Address Discovery via Curl |
production |
2026-09-18 |
| elastic |
System and Network Configuration Check |
production |
2026-09-18 |
| elastic |
Unusual Linux Network Configuration Discovery |
production |
2026-09-18 |
| elastic |
Wireless Credential Dumping using Netsh Command |
production |
2026-09-18 |
| elastic |
Active Directory Discovery using AdExplorer |
production |
2026-09-18 |
| elastic |
System Public IP Discovery via DNS Query |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| splunk |
Cisco IOS XE Reconnaissance Command Activity |
production |
2026-05-20 |
| splunk |
Windows Post Exploitation Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows Common Abused Cmd Shell Risk Behavior |
production |
2026-05-13 |
| splunk |
Windows PowerShell Invoke-RestMethod IP Information Collection |
production |
2026-05-13 |
| splunk |
Windows WinPEAS PowerShell Script Execution |
production |
2026-05-13 |
| splunk |
Windows System Network Config Discovery Display DNS |
production |
2026-05-13 |
| splunk |
Potential System Network Configuration Discovery Activity |
production |
2026-05-13 |
| sigma |
Suspicious Network Command |
test |
2025-10-19 |
| sigma |
Firewall Configuration Discovery Via Netsh.EXE |
test |
2025-10-18 |
| sigma |
System Network Discovery - macOS |
test |
2024-08-29 |
| sigma |
Suspicious Network Connection to IP Lookup Service APIs |
test |
2024-03-22 |
| sigma |
OpenCanary - SNMP OID Request |
test |
2024-03-08 |
| sigma |
Potential Pikabot Discovery Activity |
test |
2024-01-26 |
| sigma |
Potential Recon Activity Via Nltest.EXE |
test |
2023-12-15 |
| sigma |
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet |
test |
2023-07-13 |
| sigma |
Nltest.EXE Execution |
test |
2023-02-03 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
System Network Discovery - Linux |
test |
2022-09-15 |