| elastic |
Machine Learning Detected a Suspicious Windows Event with a Low Malicious Probability Score |
deprecated |
2026-10-23 |
| elastic |
Machine Learning Detected a Suspicious Windows Event with a High Malicious Probability Score |
production |
2026-10-19 |
| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-10-19 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-10-09 |
| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-10-08 |
| elastic |
ELF Binary Created in System Directory by Suspicious Process |
production |
2026-10-07 |
| splunk |
Executables Or Script Creation In Temp Path |
production |
2026-10-06 |
| splunk |
Executables Or Script Creation In Suspicious Path |
production |
2026-10-06 |
| elastic |
Masquerading Space After Filename |
production |
2026-10-05 |
| elastic |
Lure-Themed Internet-Delivered RMM Executable |
production |
2026-09-24 |
| splunk |
Cisco NVM - Non-Network Binary Making Network Connection |
production |
2026-09-22 |
| elastic |
Expired or Revoked Driver Loaded |
production |
2026-09-18 |
| elastic |
Agent Spoofing - Multiple Hosts Using Same Agent |
production |
2026-09-18 |
| elastic |
Potential Kubectl Masquerading via Unexpected Process |
production |
2026-09-18 |
| elastic |
Processes with Trailing Spaces |
production |
2026-09-18 |
| elastic |
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a Parent Process |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a User |
production |
2026-09-18 |
| elastic |
Host Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
Parent Process Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
User Detected with Suspicious Windows Process(es) |
production |
2026-09-18 |
| elastic |
Network Activity Detected via Kworker |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Potential Process Name Stomping with Prctl |
production |
2026-09-18 |
| elastic |
Suspicious Renaming of ESXI Files |
production |
2026-09-18 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Process Started from Process ID (PID) File |
production |
2026-09-18 |
| elastic |
Binary Executed from Shared Memory Directory |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Suspicious Kworker UID Elevation |
production |
2026-09-18 |
| elastic |
Potential Microsoft Office Sandbox Evasion |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Renamed COM+ Services DLL |
production |
2026-09-18 |
| elastic |
Suspicious Communication App Child Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Potential DLL Side-Loading via Trusted Microsoft Programs |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Process Execution from an Unusual Directory |
production |
2026-09-18 |
| elastic |
Execution via Windows Command Debugging Utility |
production |
2026-09-18 |
| elastic |
Suspicious Endpoint Security Parent Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Svchost |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Renamed Automation Script Interpreter |
production |
2026-09-18 |
| elastic |
Suspicious WerFault Child Process |
production |
2026-09-18 |
| elastic |
Program Files Directory Masquerading |
production |
2026-09-18 |
| elastic |
Potential Windows Error Manager Masquerading |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Renamed Utility Executed with Short Program Name |
production |
2026-09-18 |
| elastic |
Suspicious Zoom Child Process |
production |
2026-09-18 |
| elastic |
Unsigned DLL Side-Loading from a Suspicious Folder |
production |
2026-09-18 |
| elastic |
Untrusted Driver Loaded |
production |
2026-09-18 |
| elastic |
Signed Proxy Execution via MS Work Folders |
production |
2026-09-18 |
| elastic |
Execution from Unusual Directory - Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution via Renamed PsExec Executable |
production |
2026-09-18 |
| elastic |
Conhost Spawned By Suspicious Parent Process |
production |
2026-09-18 |
| elastic |
Potential Data Exfiltration via Rclone |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-33053 Exploitation |
production |
2026-09-18 |
| elastic |
Unsigned DLL Loaded by Svchost |
production |
2026-09-18 |
| elastic |
Startup Folder Persistence via Unsigned Process |
production |
2026-09-18 |
| elastic |
Potential privilege escalation via CVE-2022-38028 |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via InstallerFileTakeOver |
production |
2026-09-18 |
| elastic |
Suspicious DLL Loaded for Persistence or Privilege Escalation |
production |
2026-09-18 |
| elastic |
Potential Privileged Escalation via SamAccountName Spoofing |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Windows Directory Masquerading |
production |
2026-09-18 |
| elastic |
Unusual Parent-Child Relationship |
production |
2026-09-18 |
| elastic |
Potential Fileless Execution via O_TMPFILE |
production |
2026-09-07 |
| splunk |
Windows TinyCC Shellcode Execution |
production |
2026-09-01 |
| sigma |
System File Execution Location Anomaly |
test |
2026-07-28 |
| splunk |
Linux Possible System Binary Backdoor |
production |
2026-07-08 |
| splunk |
Linux Suspicious Staging of Alternate System Files |
production |
2026-07-08 |
| sigma |
Procdump Execution |
test |
2026-06-29 |
| snort |
ET INFO Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |
| suricata |
ET HUNTING Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |
| splunk |
Windows NetSupport RMM DLL Loaded By Uncommon Process |
production |
2026-05-13 |
| splunk |
Suspicious writes to windows Recycle Bin |
production |
2026-05-13 |
| splunk |
Windows Bluetooth Service Installed From Uncommon Location |
production |
2026-05-13 |
| splunk |
Windows Debugger Tool Execution |
production |
2026-05-13 |
| splunk |
Windows Masquerading Msdtc Process |
production |
2026-05-13 |
| splunk |
Windows Suspicious QEMU Execution |
production |
2026-05-13 |
| splunk |
Windows SoftEther VPN Masquerading as Legitimate Binary |
production |
2026-05-13 |
| elastic |
Deprecated - Process Termination followed by Deletion |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Suspicious Renaming of ESXI index.html File |
deprecated |
2026-02-04 |
| elastic |
Deprecated - Agent Spoofing - Mismatched Agent ID |
deprecated |
2026-02-04 |
| sigma |
Explorer Process Tree Break |
test |
2025-10-31 |
| sigma |
Potential LSASS Process Dump Via Procdump |
stable |
2025-10-19 |
| sigma |
Windows Binaries Write Suspicious Extensions |
test |
2025-10-07 |
| sigma |
Potentially Suspicious Execution From Tmp Folder |
test |
2025-08-05 |
| snort |
ET INFO ConnectWise ScreenConnect Revoked Code Signing Certificate M2 |
rev 1 |
2025-07-03 |
| suricata |
ET HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M1 |
rev 1 |
2025-07-03 |
| suricata |
ET HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M2 |
rev 1 |
2025-07-03 |
| snort |
ET INFO ConnectWise ScreenConnect Revoked Code Signing Certificate M1 |
rev 1 |
2025-07-03 |
| sigma |
Process Memory Dump Via Comsvcs.DLL |
test |
2025-02-23 |
| sigma |
Renamed ZOHO Dctask64 Execution |
test |
2025-01-22 |
| snort |
ET INFO Empty Location Header from CloudFlare Server 2024-12-05 |
rev 1 |
2024-12-05 |
| suricata |
ET HUNTING Empty Location Header from CloudFlare Server 2024-12-05 |
rev 1 |
2024-12-05 |
| suricata |
ET HUNTING Redirect to stockx.com |
rev 1 |
2024-09-24 |
| snort |
ET INFO Redirect to stockx.com |
rev 1 |
2024-09-24 |
| sigma |
Suspicious Child Process Of Wermgr.EXE |
test |
2024-08-29 |
| sigma |
Sdiagnhost Calling Suspicious Child Process |
test |
2024-08-23 |
| sigma |
Process Execution From A Potentially Suspicious Folder |
test |
2024-07-12 |
| sigma |
Potential Fake Instance Of Hxtsr.EXE Executed |
test |
2024-02-08 |
| sigma |
CodePage Modification Via MODE.COM |
test |
2024-01-19 |
| sigma |
New Process Created Via Taskmgr.EXE |
test |
2024-01-18 |
| sigma |
CodePage Modification Via MODE.COM To Russian Language |
test |
2024-01-17 |
| sigma |
New or Renamed User Account with '$' Character |
test |
2024-01-16 |
| sigma |
Findstr Launching .lnk File |
test |
2024-01-15 |
| sigma |
Forfiles.EXE Child Process Masquerading |
test |
2024-01-05 |
| elastic |
Potential Process Herpaderping Attempt |
deprecated |
2023-12-15 |
| sigma |
Suspicious Windows Update Agent Empty Cmdline |
test |
2023-11-11 |
| sigma |
Suspicious Calculator Usage |
test |
2023-11-09 |
| sigma |
Potential ReflectDebugger Content Execution Via WerFault.EXE |
test |
2023-06-30 |
| sigma |
Potential SysInternals ProcDump Evasion |
test |
2023-05-09 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters in Filename |
test |
2023-05-08 |
| sigma |
Potential Homoglyph Attack Using Lookalike Characters |
test |
2023-05-07 |
| sigma |
Suspicious DumpMinitool Execution |
test |
2023-04-12 |
| sigma |
DumpMinitool Execution |
test |
2023-04-12 |
| sigma |
Potential Command Line Path Traversal Evasion Attempt |
test |
2023-03-29 |
| sigma |
Suspicious CodePage Switch Via CHCP |
test |
2023-03-07 |
| sigma |
PUA - Potential PE Metadata Tamper Using Rcedit |
test |
2023-03-05 |
| sigma |
Renamed CreateDump Utility Execution |
test |
2023-02-14 |
| sigma |
HackTool - XORDump Execution |
test |
2023-02-08 |
| sigma |
Suspicious MSDT Parent Process |
test |
2023-02-06 |
| sigma |
Renamed Plink Execution |
test |
2023-02-03 |
| sigma |
Suspicious Computer Account Name Change CVE-2021-42287 |
test |
2022-12-25 |
| sigma |
Suspicious Process Parents |
test |
2022-09-08 |
| sigma |
CreateDump Process Dump |
test |
2022-08-19 |
| sigma |
Taskmgr as LOCAL_SYSTEM |
test |
2022-05-27 |
| sigma |
Password Protected ZIP File Opened (Suspicious Filenames) |
test |
2022-05-09 |
| sigma |
Interactive Bash Suspicious Children |
test |
2022-03-14 |
| sigma |
Suspicious Process Start Locations |
test |
2022-01-07 |
| sentinel |
Potential re-named sdelete usage (ASIM Version) |
Scheduled |
— |