| elastic |
Suspicious /proc/maps Discovery |
production |
2026-10-09 |
| elastic |
ESXi Virtual Machine Process List |
production |
2026-09-30 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Dynamic Linker Discovery via od |
production |
2026-09-18 |
| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Memory grep Activity |
production |
2026-09-18 |
| elastic |
Process Capability Enumeration |
production |
2026-09-18 |
| elastic |
Potential Linux Credential Dumping via Proc Filesystem |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Enumeration Command Spawned via WMIPrvSE |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Discovery Activity |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Potential Linux Hack Tool Launched |
production |
2026-09-18 |
| elastic |
Suspicious Reading of procfs Syscall File |
production |
2026-09-18 |
| splunk |
Windows Process Commandline Discovery |
production |
2026-05-13 |
| elastic |
Deprecated - Potential Pspy Process Monitoring Detected |
deprecated |
2026-02-04 |
| sigma |
Potential Process Reconnaissance via Wmic.EXE |
test |
2025-12-15 |
| sigma |
System Info Discovery via Sysinfo Syscall |
experimental |
2025-12-05 |
| sigma |
Recon Command Output Piped To Findstr.EXE |
test |
2025-10-08 |
| sigma |
HackTool - PCHunter Execution |
test |
2024-11-23 |
| sigma |
Cisco Discovery |
test |
2023-01-04 |
| sigma |
Suspicious Tasklist Discovery Command |
test |
2022-12-25 |
| sigma |
Process Discovery |
stable |
2022-07-07 |
| sigma |
Suspicious Process Discovery With Get-Process |
test |
2022-03-17 |
| elastic |
Process Discovery via Tasklist |
deprecated |
2021-04-15 |
| suricata |
ET MALWARE Outbound POST Request with ps PowerShell Command Output |
rev 4 |
2020-09-01 |
| suricata |
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M1 |
rev 3 |
2020-08-28 |
| suricata |
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M3 |
rev 3 |
2020-08-28 |
| suricata |
ET MALWARE Outbound POST Request with Base64 ps PowerShell Command Output M2 |
rev 3 |
2020-08-28 |
| snort |
ET TROJAN Outbound POST Request with ps PowerShell Command Output |
rev 3 |
2019-08-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M1 |
rev 2 |
2019-04-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M2 |
rev 2 |
2019-04-16 |
| snort |
ET TROJAN Outbound POST Request with Base64 ps PowerShell Command Output M3 |
rev 2 |
2019-04-16 |