| sigma |
Uncommon Svchost Parent Process |
test |
2026-10-19 |
| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-10-19 |
| elastic |
ELF Binary Created in System Directory by Suspicious Process |
production |
2026-10-07 |
| splunk |
Attacker Tools On Endpoint |
production |
2026-09-22 |
| splunk |
Windows LOLBAS Executed Outside Expected Path |
production |
2026-09-22 |
| elastic |
Potential Windows Error Manager Masquerading |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Directory Creation in /bin directory |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Potential Process Name Stomping with Prctl |
production |
2026-09-18 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Process Started from Process ID (PID) File |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Potential Microsoft Office Sandbox Evasion |
production |
2026-09-18 |
| elastic |
Suspicious Communication App Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Antimalware Service Execution |
production |
2026-09-18 |
| elastic |
Process Execution from an Unusual Directory |
production |
2026-09-18 |
| elastic |
Execution via Windows Command Debugging Utility |
production |
2026-09-18 |
| elastic |
Suspicious Endpoint Security Parent Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Svchost |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Program Files Directory Masquerading |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Signed Proxy Execution via MS Work Folders |
production |
2026-09-18 |
| elastic |
Execution from Unusual Directory - Command Line |
production |
2026-09-18 |
| elastic |
Potential CVE-2025-33053 Exploitation |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via InstallerFileTakeOver |
production |
2026-09-18 |
| elastic |
UAC Bypass Attempt via Windows Directory Masquerading |
production |
2026-09-18 |
| elastic |
Potential Fileless Execution via O_TMPFILE |
production |
2026-09-07 |
| splunk |
Windows Suspicious Process File Path |
production |
2026-09-01 |
| splunk |
Windows Process Execution in Temp Dir |
production |
2026-09-01 |
| sigma |
Unsigned .node File Loaded |
experimental |
2026-08-27 |
| sigma |
Files With System Process Name In Unsuspected Locations |
test |
2026-07-28 |
| splunk |
Windows Process Execution From ProgramData |
production |
2026-06-08 |
| splunk |
Windows MSC EvilTwin Directory Path Manipulation |
production |
2026-05-13 |
| sigma |
Suspicious WSL Binary Masquerading |
experimental |
2026-05-05 |
| sigma |
Suspicious WSL Binary Hijack via Proxy Execution |
experimental |
2026-05-05 |
| sigma |
Potential WSL Binary Modification from Installed Location |
experimental |
2026-05-05 |
| sigma |
RedSun - TieringEngineService.exe Detected as EICAR Test File |
experimental |
2026-04-17 |
| sigma |
RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir |
experimental |
2026-04-17 |
| sigma |
RedSun - Conhost.exe Spawned by TieringEngineService.exe |
experimental |
2026-04-17 |
| sigma |
Uncommon Svchost Command Line Parameter |
experimental |
2026-03-23 |
| sigma |
Potential Binary Impersonating Sysinternals Tools |
test |
2025-04-12 |
| sigma |
Windows Processes Suspicious Parent Directory |
test |
2025-03-06 |
| sigma |
Scheduled Task Creation Masquerading as System Processes |
experimental |
2025-02-05 |
| sigma |
Suspicious Scheduled Task Creation via Masqueraded XML File |
test |
2024-12-01 |
| sigma |
Suspicious Process Masquerading As SvcHost.EXE |
test |
2024-08-07 |
| sigma |
Files With System DLL Name In Unsuspected Locations |
test |
2024-06-24 |
| sigma |
Creation Of Pod In System Namespace |
test |
2024-03-26 |
| sigma |
Small Sieve Malware File Indicator Creation |
test |
2023-05-19 |
| sigma |
Lazarus System Binary Masquerading |
test |
2023-03-10 |
| sigma |
Greenbug Espionage Group Indicators |
test |
2023-03-09 |
| sigma |
Potential MsiExec Masquerading |
test |
2023-02-21 |
| sigma |
Flash Player Update from Suspicious Location |
test |
2022-08-08 |
| sigma |
Suspicious Files in Default GPO Folder |
test |
2022-04-28 |
| sigma |
Exploit for CVE-2015-1641 |
stable |
2021-11-27 |