| splunk |
Inline PHP Code Execution |
production |
2026-10-28 |
| elastic |
Suspicious Command Execution from Visual Studio Code |
production |
2026-10-26 |
| elastic |
Web Shell Detection: Script Process Child of Common Web Processes |
production |
2026-10-23 |
| elastic |
Potential NetScaler Log Poisoning Command Injection Attempt |
production |
2026-10-23 |
| elastic |
AWS SSM Session Manager Child Process Execution |
production |
2026-10-21 |
| elastic |
AWS EKS Pod Exec Potential Reverse Shell |
production |
2026-10-20 |
| elastic |
Suspicious Windows Powershell Arguments |
production |
2026-10-19 |
| elastic |
Potential PowerShell Obfuscated Script via High Entropy |
production |
2026-10-19 |
| elastic |
Memory Swap Modification |
production |
2026-10-09 |
| elastic |
Suspicious Content Extracted or Decompressed via Funzip |
production |
2026-10-09 |
| elastic |
Potential Proxy Execution via Systemd-run |
production |
2026-10-09 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-10-09 |
| elastic |
Suspicious React Server Child Process |
production |
2026-10-09 |
| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| splunk |
Ollama Suspicious Prompt Injection Jailbreak |
deprecated |
2026-10-09 |
| elastic |
Shared Object Load via LoLBin |
production |
2026-10-09 |
| splunk |
Windows Scheduled Task Service Spawned Shell |
production |
2026-10-09 |
| elastic |
Proxy Execution via Console Window Host |
production |
2026-10-09 |
| elastic |
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process |
production |
2026-10-09 |
| elastic |
Suspicious Windows Command Shell Arguments |
production |
2026-10-09 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-10-09 |
| elastic |
Suspicious Command Execution via Web Server |
production |
2026-10-09 |
| elastic |
Suspicious Child Execution via Web Server |
production |
2026-10-09 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-10-08 |
| elastic |
Process Backgrounded by Unusual Parent |
production |
2026-10-08 |
| elastic |
Unusual Pkexec Execution |
production |
2026-10-08 |
| elastic |
Network Connections Initiated Through XDG Autostart Entry |
production |
2026-10-08 |
| elastic |
Exec Into Container Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-10-08 |
| elastic |
File Creation, Execution and Self-Deletion in Suspicious Directory |
production |
2026-10-08 |
| elastic |
File Execution Permission Modification Detected via Defend for Containers |
production |
2026-10-08 |
| elastic |
First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN |
production |
2026-10-06 |
| elastic |
Command Execution via SolarWinds Process |
production |
2026-10-06 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-10-06 |
| elastic |
Potential Redis Lua Use-After-Free RCE Attempt (CVE-2025-49844 / RediShell) |
production |
2026-10-06 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-10-06 |
| elastic |
Incoming Execution via PowerShell Remoting |
production |
2026-10-06 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| elastic |
Potential Reverse Shell Activity via Terminal |
production |
2026-10-05 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
Potential Reverse Shell via Java |
production |
2026-10-05 |
| elastic |
Curl Execution via Shell Profile |
production |
2026-10-05 |
| elastic |
PowerShell Obfuscation via Negative Index String Reversal |
production |
2026-10-05 |
| elastic |
Execution via MSSQL xp_cmdshell Stored Procedure |
production |
2026-10-05 |
| elastic |
Potential ClickFix Command via Windows Run Dialog |
production |
2026-10-05 |
| splunk |
Windows Identify Protocol Handlers |
production |
2026-10-02 |
| elastic |
ESXi Shell Command Obfuscation |
production |
2026-09-30 |
| elastic |
Zimbra Swatchdog SNMP Command Injection Execution |
production |
2026-09-30 |
| elastic |
ESXi Payload Executed Against Datastore |
production |
2026-09-30 |
| elastic |
First Time Python Spawned a Shell on Host |
production |
2026-09-29 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Potential TerminalFix Cloudflare Lure in PowerShell |
production |
2026-09-28 |
| elastic |
Unusual File Creation via Web Server |
production |
2026-09-27 |
| elastic |
AWS Bedrock High Risk Filesystem or Execution Tool Invocation |
production |
2026-09-25 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| sigma |
Potential Netcat Reverse Shell Execution |
test |
2026-09-24 |
| splunk |
Windows Renamed Command Interpreter was Executed |
production |
2026-09-23 |
| elastic |
Network Connection to OAST Domain via Script Interpreter |
production |
2026-09-23 |
| elastic |
Curl Download Activity from npm Package Install |
production |
2026-09-23 |
| splunk |
Cisco NVM - Browser Spawned Unix Shell with External Connection |
production |
2026-09-22 |
| elastic |
Kubernetes Pod Exec Potential Reverse Shell |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - Binary File Type Download |
production |
2026-09-22 |
| splunk |
Windows Defender ASR Rules Stacking |
production |
2026-09-22 |
| splunk |
Windows Defender ASR Block Events |
production |
2026-09-22 |
| splunk |
Windows Defender ASR Audit Events |
production |
2026-09-22 |
| splunk |
Cisco NVM - Installation of Typosquatted Python Package |
production |
2026-09-22 |
| elastic |
Suspicious PowerShell from npm Package Install |
production |
2026-09-22 |
| splunk |
Cisco NVM - Suspicious File Download via Headless Browser |
production |
2026-09-22 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Potential Meterpreter Reverse Shell |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Suspicious Binary |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via UDP |
production |
2026-09-18 |
| elastic |
Suspicious System Commands Executed by Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Suspicious Mining Process Creation Event |
production |
2026-09-18 |
| elastic |
Suspicious Named Pipe Creation |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
System Binary Path File Permission Modification |
production |
2026-09-18 |
| elastic |
BPF filter applied using TC |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Interactive Shell Launched via Unusual Parent Process in a Container |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Suspicious Path Invocation from Command Line |
production |
2026-09-18 |
| elastic |
File Transfer Utility Launched from Unusual Parent |
production |
2026-09-18 |
| elastic |
Suspicious Data Encryption via OpenSSL Utility |
production |
2026-09-18 |
| elastic |
Potential Malware-Driven SSH Brute Force Attempt |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Network Connection |
production |
2026-09-18 |
| elastic |
Boot File Copy |
production |
2026-09-18 |
| elastic |
Unusual D-Bus Daemon Child Process |
production |
2026-09-18 |
| elastic |
Dracut Module Creation |
production |
2026-09-18 |
| elastic |
Git Hook Command Execution |
production |
2026-09-18 |
| elastic |
Git Hook Created or Modified |
production |
2026-09-18 |
| elastic |
Git Hook Egress Network Connection |
production |
2026-09-18 |
| elastic |
Git Hook Child Process |
production |
2026-09-18 |
| elastic |
Manual Dracut Execution |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
NetworkManager Dispatcher Script Creation |
production |
2026-09-18 |
| elastic |
Potential Backdoor Execution Through PAM_EXEC |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Systemd Shell Execution During Boot |
production |
2026-09-18 |
| elastic |
Initramfs Unpacking via unmkinitramfs |
production |
2026-09-18 |
| elastic |
Unusual Exim4 Child Process |
production |
2026-09-18 |
| elastic |
PHP File Creation in WordPress Plugin Directory |
production |
2026-09-18 |
| elastic |
Unusual Child Execution via Web Server |
production |
2026-09-18 |
| elastic |
Unusual Command Execution via Web Server |
production |
2026-09-18 |
| elastic |
Root Network Connection via GDB CAP_SYS_PTRACE |
production |
2026-09-18 |
| elastic |
Suspicious UID Change to Root via Python |
production |
2026-09-18 |
| elastic |
Potential Shell via Wildcard Injection Detected |
production |
2026-09-18 |
| elastic |
Potential Privilege Escalation via Python cap_setuid |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Prompt for Credentials with Osascript |
production |
2026-09-18 |
| elastic |
Execution via Electron Child Process Node.js Module |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Suspicious Automator Workflows Execution |
production |
2026-09-18 |
| elastic |
Apple Script Execution followed by Network Connection |
production |
2026-09-18 |
| elastic |
Shell Execution via Apple Scripting |
production |
2026-09-18 |
| elastic |
Unusual Library Load via Python |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Creation of Hidden Login Item via Apple Script |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Persistence via Folder Action Script |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Pkg Install Script |
production |
2026-09-18 |
| elastic |
Apple Scripting Execution with Administrator Privileges |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| elastic |
Suspicious Powershell Script |
production |
2026-09-18 |
| elastic |
Rare Powershell Script |
production |
2026-09-18 |
| elastic |
Anomalous Windows Process Creation |
production |
2026-09-18 |
| elastic |
Cassandra JavaScript UDF Creation |
production |
2026-09-18 |
| elastic |
PostgreSQL COPY PROGRAM Command Execution |
production |
2026-09-18 |
| elastic |
React2Shell (CVE-2025-55182) Exploitation Attempt |
production |
2026-09-18 |
| elastic |
React2Shell Network Security Alert |
production |
2026-09-18 |
| elastic |
Exporting Exchange Mailbox via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Audio Capture Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Clipboard Retrieval Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Keylogging Script |
production |
2026-09-18 |
| elastic |
PowerShell Mailbox Collection Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Screenshot Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Script with Webcam Video Capture Capabilities |
production |
2026-09-18 |
| elastic |
Remote File Download via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Shell Execution via Velociraptor |
production |
2026-09-18 |
| elastic |
PowerShell Invoke-NinjaCopy script |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
PowerShell MiniDump Script |
production |
2026-09-18 |
| elastic |
Potential PowerShell Pass-the-Hash/Relay Script |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Request |
production |
2026-09-18 |
| elastic |
PowerShell Script with Veeam Credential Access Capabilities |
production |
2026-09-18 |
| elastic |
Veeam Backup Library Loaded by Unusual Process |
production |
2026-09-18 |
| elastic |
Potential Veeam Credential Access Command |
production |
2026-09-18 |
| elastic |
Potential Antimalware Scan Interface Bypass via PowerShell |
production |
2026-09-18 |
| elastic |
Potential AMSI Bypass via RPC Runtime Hooking |
production |
2026-09-18 |
| elastic |
Clearing Windows Console History |
production |
2026-09-18 |
| elastic |
Windows Defender Exclusions Added via PowerShell |
production |
2026-09-18 |
| elastic |
Disabling Windows Defender Security Settings via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Renamed Automation Script Interpreter |
production |
2026-09-18 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Payload Encoded and Compressed |
production |
2026-09-18 |
| elastic |
PowerShell Script with Windows Defender Tampering Capabilities |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Invalid Escape Sequences |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Character Array Reconstruction |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |
| elastic |
Potential Dynamic IEX Reconstruction via Environment Variables |
production |
2026-09-18 |
| elastic |
Dynamic IEX Reconstruction via Method String Access |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Reverse Keywords |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Concatenation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Reordering |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Special Character Overuse |
production |
2026-09-18 |
| elastic |
Potential Process Injection via PowerShell |
production |
2026-09-18 |
| elastic |
Windows Firewall Disabled via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
Suspicious Script Object Execution |
production |
2026-09-18 |
| elastic |
Suspicious Zoom Child Process |
production |
2026-09-18 |
| elastic |
Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Host File System Changes via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Attempt to Install or Run Kali Linux via WSL |
production |
2026-09-18 |
| elastic |
Windows Subsystem for Linux Distribution Installed |
production |
2026-09-18 |
| elastic |
PowerShell Share Enumeration Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
Suspicious Child Process via Azure VM CustomScript Extension |
production |
2026-09-18 |
| elastic |
Suspicious Command Prompt Network Connection |
production |
2026-09-18 |
| elastic |
Svchost spawning Cmd |
production |
2026-09-18 |
| elastic |
Unusual Parent Process for cmd.exe |
production |
2026-09-18 |
| elastic |
Command Shell Activity Started via RunDLL32 |
production |
2026-09-18 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| elastic |
Execution from Unusual Directory - Command Line |
production |
2026-09-18 |
| elastic |
Suspicious Execution with NodeJS |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Author |
production |
2026-09-18 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Potential Malicious PowerShell Based on Alert Correlation |
production |
2026-09-18 |
| elastic |
Suspicious Portable Executable Encoded in Powershell Script |
production |
2026-09-18 |
| elastic |
PowerShell PSReflect Script |
production |
2026-09-18 |
| elastic |
Command and Scripting Interpreter via Windows Scripts |
production |
2026-09-18 |
| elastic |
Potential Command Shell via NetCat |
production |
2026-09-18 |
| elastic |
Outbound Scheduled Task Activity via PowerShell |
production |
2026-09-18 |
| elastic |
Windows Script Execution from Archive |
production |
2026-09-18 |
| elastic |
Suspicious JavaScript Execution via Deno |
production |
2026-09-18 |
| elastic |
Suspicious Cmd Execution via WMI |
production |
2026-09-18 |
| elastic |
Suspicious PowerShell Engine ImageLoad |
production |
2026-09-18 |
| elastic |
Process Activity via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Conhost Spawned By Suspicious Parent Process |
production |
2026-09-18 |
| elastic |
Microsoft Management Console File from Unusual Path |
production |
2026-09-18 |
| elastic |
Potential Fake CAPTCHA Phishing Attack |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| elastic |
AzCopy or Azure Storage Explorer Usage on Unusual Host |
production |
2026-09-18 |
| elastic |
Volume Shadow Copy Deletion via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious JetBrains TeamCity Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Child Process of PaperCut Server Component |
production |
2026-09-18 |
| elastic |
Windows Script Executing PowerShell |
production |
2026-09-18 |
| elastic |
Windows Script Interpreter Executing Process via WMI |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Microsoft Exchange Worker Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Suspicious MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| elastic |
Windows Server Update Service Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
ScreenConnect Server Spawning Suspicious Processes |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Potential SharpRDP Behavior |
production |
2026-09-18 |
| elastic |
Scheduled Task Created by a Windows Script |
production |
2026-09-18 |
| elastic |
New ActiveSyncAllowedDeviceID Added via PowerShell |
production |
2026-09-18 |
| elastic |
Execution of Persistent Suspicious Program |
production |
2026-09-18 |
| elastic |
System Shells via Services |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
ROT Encoded Python Script Execution |
production |
2026-09-18 |
| elastic |
Command Line Obfuscation via Whitespace Padding |
production |
2026-09-18 |
| elastic |
AWS EC2 LOLBin Execution via SSM SendCommand |
production |
2026-09-18 |
| elastic |
AWS SSM `SendCommand` with Run Shell Command Parameters |
production |
2026-09-18 |
| elastic |
Azure Run Command Script Child Process |
production |
2026-09-18 |
| elastic |
Azure Run Command Correlated with Process Execution |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Common Utilities |
production |
2026-09-18 |
| elastic |
Forbidden Direct Interactive Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Direct Interactive Kubernetes API Request by Unusual Utilities |
production |
2026-09-18 |
| elastic |
Service Account Token or Certificate Access Followed by Kubernetes API Request |
production |
2026-09-18 |
| elastic |
Potential Git CVE-2025-48384 Exploitation |
production |
2026-09-18 |
| elastic |
Kubernetes Direct API Request via Curl or Wget |
production |
2026-09-18 |
| elastic |
Privileged Container Creation with Host Directory Mount |
production |
2026-09-18 |
| elastic |
Remote GitHub Actions Runner Registration |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver WebShell Creation |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Potential Java Service Exploitation via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution by Zoom |
production |
2026-09-18 |
| elastic |
Suspicious Python Shell Command Execution |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Tampering with RUNNER_TRACKING_ID in GitHub Actions Runners |
production |
2026-09-18 |
| elastic |
Suspicious Java Class File Created in PaperCut Server Library |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Web Server Potential SQL Injection Request |
production |
2026-09-18 |
| elastic |
AWS Batch Job Submitted with Container Override by Unusual Identity |
production |
2026-09-18 |
| elastic |
AWS CloudShell Environment Created |
production |
2026-09-18 |
| elastic |
AWS EC2 Stop, Start, and User Data Modification Correlation |
production |
2026-09-18 |
| elastic |
AWS SageMaker Notebook Lifecycle Configuration With Suspicious Script Content |
production |
2026-09-18 |
| elastic |
Azure AKS Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Entra ID PowerShell Sign-in |
production |
2026-09-18 |
| elastic |
File Download Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Direct Kubernetes API Request Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
System Path File Creation and Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Interactive Shell Spawn Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Netcat File Transfer or Listener Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Payload Execution via Shell Pipe Detected by Defend for Containers |
production |
2026-09-18 |
| elastic |
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Web Server Exploitation Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Potential Reverse Shell |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
GitHub Actions Unusual Bot Push to Repository |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
M365 SharePoint/OneDrive File Access via PowerShell |
production |
2026-09-18 |
| elastic |
Network Connection by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Shell Execution via Elastic Endpoint |
production |
2026-09-18 |
| elastic |
Network Connection Followed by File Creation |
production |
2026-09-18 |
| elastic |
GitHub Authentication Token Access via Node.js |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Proxy Shell Execution via Busybox |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
Unusual Interactive Shell Launched from System User |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Potentially Suspicious Process Started via tmux or screen |
production |
2026-09-18 |
| elastic |
File Creation in /var/log via Suspicious Process |
production |
2026-09-18 |
| elastic |
Potential Kubeletctl Execution |
production |
2026-09-18 |
| elastic |
Suspicious Command Execution via Busybox Proxy |
production |
2026-09-18 |
| elastic |
File Creation by Cups or Foomatic-rip Child |
production |
2026-09-18 |
| elastic |
Printer User (lp) Shell Execution |
production |
2026-09-18 |
| elastic |
Cupsd or Foomatic-rip Shell Execution |
production |
2026-09-18 |
| elastic |
Egress Connection from Entrypoint in Container |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
Suspicious File Made Executable via Chmod Inside A Container |
production |
2026-09-18 |
| elastic |
File Transfer or Listener Established via Netcat |
production |
2026-09-18 |
| elastic |
Potential Upgrade of Non-interactive Shell |
production |
2026-09-18 |
| elastic |
Netcat Listener Established via rlwrap |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Network Connection via Recently Compiled Executable |
production |
2026-09-18 |
| elastic |
File Downloaded by Curl/Wget and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Payload Downloaded by Interpreter and Piped to Interpreter |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Perl |
production |
2026-09-18 |
| elastic |
Privileged Docker Container Creation |
production |
2026-09-18 |
| elastic |
Process Started from Process ID (PID) File |
production |
2026-09-18 |
| elastic |
Binary Executed from Shared Memory Directory |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Python |
production |
2026-09-18 |
| elastic |
Web Server Spawned via Python |
production |
2026-09-18 |
| elastic |
Potential Code Execution via Postgresql |
production |
2026-09-18 |
| elastic |
Direct Process Execution via Background Utility |
production |
2026-09-18 |
| elastic |
Openssl Client or Server Activity |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Background Process |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Child |
production |
2026-09-18 |
| elastic |
Suspicious Linux Process Connection to Bulletproof Hosting ASN |
production |
2026-09-17 |
| splunk |
Windows Process Accessing IronLanguages Repository On GitHub |
production |
2026-09-16 |
| sigma |
Elevated System Shell Spawned |
test |
2026-09-15 |
| splunk |
Linux Ghostscript Exploitation |
production |
2026-09-01 |
| splunk |
Socat Remote TCP Connection with Local Echo Disabled |
production |
2026-08-27 |
| splunk |
Socat Network Listener Binding an Executable |
production |
2026-08-27 |
| elastic |
Deprecated - Potential PowerShell Obfuscated Script |
deprecated |
2026-08-19 |
| splunk |
Windows Suspicious Child Process of Consent.EXE |
production |
2026-07-30 |
| splunk |
Linux Binary Executed from Shared Memory Directory |
production |
2026-07-08 |
| splunk |
Linux Shell Pseudo Device Reverse Shell |
production |
2026-07-08 |
| elastic |
Deprecated - Unusual Command Execution from Web Server Parent |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Uncommon Destination Port Connection by Web Server |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Linux Restricted Shell Breakout via Linux Binary(s) |
deprecated |
2026-07-02 |
| elastic |
Deprecated - EggShell Backdoor Execution |
deprecated |
2026-07-02 |
| splunk |
PTC Windchill GW READY OK Probe |
production |
2026-06-14 |
| splunk |
PTC Windchill Gateway Command Execution |
production |
2026-06-14 |
| sigma |
Vim GTFOBin Abuse - Linux |
test |
2026-06-05 |
| splunk |
Cisco IOS XE Request Platform Package Describe Shell Pattern |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Guestshell Activation and Destroy |
production |
2026-05-20 |
| splunk |
Excessive distinct processes from Windows Temp |
production |
2026-05-13 |
| splunk |
Excessive number of taskhost processes |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High Volume of Intrusion Events Per Host |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
Windows WinDBG Spawning AutoIt3 |
production |
2026-05-13 |
| splunk |
Windows TeamCity Plugin Installed |
production |
2026-05-13 |
| splunk |
Windows TeamCity Payload Execution from Temp Directory |
production |
2026-05-13 |
| splunk |
Windows Suspicious VMWare Tools Child Process |
production |
2026-05-13 |
| splunk |
Process Writing DynamicWrapperX |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows Process Execution From RDP Share |
production |
2026-05-13 |
| splunk |
Windows Process Accessing Windows Recall Directory |
production |
2026-05-13 |
| splunk |
Windows PaperCut NG Spawn Shell |
production |
2026-05-13 |
| splunk |
Windows Common Abused Cmd Shell Risk Behavior |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Possibly Compromised Host |
experimental |
2026-05-13 |
| splunk |
Windows Command and Scripting Interpreter Path Traversal Exec |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Privileged Command Execution via HTTP |
production |
2026-05-13 |
| splunk |
Windows Command and Scripting Interpreter Hunting Path Traversal |
production |
2026-05-13 |
| splunk |
Windows AutoIt3 Execution |
production |
2026-05-13 |
| splunk |
Windows Apache Benchmark Binary |
production |
2026-05-13 |
| splunk |
Wermgr Process Spawned CMD Or Powershell Process |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Wget or Curl Download |
production |
2026-05-13 |
| splunk |
Detect Outbound LDAP Traffic |
production |
2026-05-13 |
| splunk |
Juniper Networks Remote Code Execution Exploit Detection |
production |
2026-05-13 |
| splunk |
Log4Shell CVE-2021-44228 Exploitation |
production |
2026-05-13 |
| splunk |
Living Off The Land Detection |
production |
2026-05-13 |
| splunk |
ESXi Reverse Shell Patterns |
production |
2026-05-13 |
| splunk |
MCP Filesystem Server Suspicious Extension Write |
production |
2026-05-13 |
| splunk |
MCP Prompt Injection |
production |
2026-05-13 |
| sigma |
BPFDoor Abnormal Process ID or Lock File Accessed |
test |
2026-03-30 |
| sigma |
Script Interpreter Execution From Suspicious Folder |
test |
2026-02-17 |
| sigma |
Linux Suspicious Child Process from Node.js - React2Shell |
experimental |
2025-12-05 |
| sigma |
Windows Suspicious Child Process from Node.js - React2Shell |
experimental |
2025-12-05 |
| sigma |
Shai-Hulud Malware Indicators - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malware Indicators - Windows |
experimental |
2025-11-25 |
| sigma |
Suspicious ArcSOC.exe Child Process |
experimental |
2025-11-25 |
| sigma |
Potentially Suspicious NTFS Symlink Behavior Modification |
test |
2025-11-13 |
| sigma |
Installation of WSL Kali-Linux |
experimental |
2025-10-10 |
| sigma |
Python Inline Command Execution |
test |
2025-10-07 |
| sigma |
PowerShell Download and Execution Cradles |
test |
2025-07-18 |
| suricata |
ET HUNTING Dotted Quad Host Base64-Encoded Powershell Payload |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING Dotted Quad Host Base64-Encoded PHP payload |
rev 1 |
2025-06-16 |
| snort |
ET INFO Dotted Quad Host Base64-Encoded Powershell Payload |
rev 1 |
2025-06-16 |
| snort |
ET INFO Dotted Quad Host Base64-Encoded PHP payload |
rev 1 |
2025-06-16 |
| suricata |
ET HUNTING HTTP Response Containing Base64-Encoded and Compressed Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| snort |
ET INFO HTTP Response Containing Base64-Encoded Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| snort |
ET INFO HTTP Response Containing Base64-Encoded and Compressed Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| suricata |
ET HUNTING HTTP Response Containing Base64-Encoded Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| sigma |
Elevated System Shell Spawned From Uncommon Parent Location |
test |
2025-03-06 |
| sigma |
Conhost Spawned By Uncommon Parent Process |
test |
2025-03-06 |
| sigma |
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location |
experimental |
2025-01-20 |
| sigma |
Shell Execution via Rsync - Linux |
experimental |
2025-01-18 |
| sigma |
Suspicious Invocation of Shell via Rsync |
experimental |
2025-01-18 |
| elastic |
Deprecated - Suspicious JAVA Child Process |
deprecated |
2025-01-17 |
| sigma |
HackTool - Stracciatella Execution |
test |
2024-11-23 |
| sigma |
Python Spawning Pretty TTY Via PTY Module |
test |
2024-11-04 |
| sigma |
Suspicious Invocation of Shell via AWK - Linux |
test |
2024-09-02 |
| sigma |
Capsh Shell Invocation - Linux |
test |
2024-09-02 |
| sigma |
Shell Execution via Git - Linux |
test |
2024-09-02 |
| sigma |
Inline Python Execution - Spawn Shell Via OS System Library |
test |
2024-09-02 |
| sigma |
Shell Invocation Via Ssh - Linux |
test |
2024-08-29 |
| sigma |
Manual Execution of Script Inside of a Compressed File |
test |
2024-08-13 |
| sigma |
Potentially Suspicious Execution From Parent Process In Public Folder |
test |
2024-07-12 |
| sigma |
DarkGate - Drop DarkGate Loader In C:\Temp Directory |
test |
2024-05-31 |
| sigma |
Potential Arbitrary Command Execution Via FTP.EXE |
test |
2024-04-23 |
| sigma |
Use of FSharp Interpreters |
test |
2024-04-23 |
| sigma |
Potential KamiKakaBot Activity - Lure Document Execution |
test |
2024-03-22 |
| sigma |
Renamed NirCmd.EXE Execution |
test |
2024-03-11 |
| sigma |
Forfiles Command Execution |
test |
2024-03-05 |
| sigma |
Renamed PingCastle Binary Execution |
test |
2024-01-11 |
| sigma |
Suspicious Greedy Compression Using Rar.EXE |
test |
2024-01-02 |
| sigma |
Unusual Parent Process For Cmd.EXE |
test |
2023-12-05 |
| sigma |
Add Potential Suspicious New Download Source To Winget |
test |
2023-12-04 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Windows) |
test |
2023-11-14 |
| sigma |
CVE-2023-22518 Exploitation Attempt - Suspicious Confluence Child Process (Linux) |
test |
2023-11-14 |
| elastic |
Deprecated - Potential Reverse Shell via Suspicious Parent Process |
deprecated |
2023-11-02 |
| sigma |
DarkGate - Autoit3.EXE Execution Parameters |
test |
2023-10-15 |
| sigma |
DarkGate - Autoit3.EXE File Creation By Uncommon Process |
test |
2023-10-15 |
| sigma |
Renamed CURL.EXE Execution |
test |
2023-10-12 |
| sigma |
VMToolsd Suspicious Child Process |
test |
2023-07-25 |
| sigma |
Ursnif Redirection Of Discovery Commands |
test |
2023-07-16 |
| sigma |
Abusable DLL Potential Sideloading From Suspicious Location |
test |
2023-07-11 |
| elastic |
Reverse Shell Created via Named Pipe |
deprecated |
2023-07-04 |
| sigma |
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script |
test |
2023-06-14 |
| sigma |
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script |
test |
2023-06-14 |
| sigma |
Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE |
test |
2023-06-01 |
| sigma |
Wscript Shell Run In CommandLine |
test |
2023-05-15 |
| sigma |
Suspicious File Created In PerfLogs |
test |
2023-05-05 |
| sigma |
Potential Xterm Reverse Shell |
test |
2023-04-24 |
| sigma |
Add Insecure Download Source To Winget |
test |
2023-04-17 |
| sigma |
Add New Download Source To Winget |
test |
2023-04-17 |
| sigma |
Install New Package Via Winget Local Manifest |
test |
2023-04-17 |
| sigma |
Suspicious Browser Child Process - MacOS |
test |
2023-04-05 |
| sigma |
Potential CobaltStrike Process Patterns |
test |
2023-03-29 |
| sigma |
Windows Shell/Scripting Application File Write to Suspicious Folder |
test |
2023-03-29 |
| sigma |
Suspicious Program Names |
test |
2023-03-22 |
| sigma |
Lazarus Group Activity |
test |
2023-03-10 |
| sigma |
Potential Dosfuscation Activity |
test |
2023-03-06 |
| sigma |
HackTool - Sliver C2 Implant Activity Pattern |
test |
2023-03-05 |
| sigma |
Suspicious Installer Package Child Process |
test |
2023-02-18 |
| sigma |
PUA - Wsudo Suspicious Execution |
test |
2023-02-14 |
| sigma |
Potential Atlassian Confluence CVE-2021-26084 Exploitation Attempt |
test |
2023-02-13 |
| sigma |
Suspicious Remote Child Process From Outlook |
test |
2023-02-09 |
| sigma |
Outlook EnableUnsafeClientMailRules Setting Enabled |
test |
2023-02-09 |
| sigma |
Potential CVE-2021-40444 Exploitation Attempt |
test |
2023-02-04 |
| sigma |
Renamed FTP.EXE Execution |
test |
2023-02-03 |
| sigma |
Use of Pcalua For Execution |
test |
2023-01-04 |
| sigma |
Perl Inline Command Execution |
test |
2023-01-02 |
| sigma |
Php Inline Command Execution |
test |
2023-01-02 |
| sigma |
Ruby Inline Command Execution |
test |
2023-01-02 |
| sigma |
Suspicious Execution via macOS Script Editor |
test |
2022-12-28 |
| sigma |
Windows Defender AMSI Trigger Detected |
stable |
2022-12-07 |
| sigma |
Windows Defender Exclusions Added - PowerShell |
test |
2022-11-26 |
| sigma |
Payload Decoded and Decrypted via Built-in Utilities |
test |
2022-10-17 |
| sigma |
PCRE.NET Package Image Load |
test |
2022-10-09 |
| sigma |
PCRE.NET Package Temp Files |
test |
2022-10-09 |
| sigma |
Hacktool Ruler |
test |
2022-10-09 |
| sigma |
Turla Group Lateral Movement |
test |
2022-10-09 |
| sigma |
Azure New CloudShell Created |
test |
2022-08-23 |
| sigma |
Suspicious Runscripthelper.exe |
test |
2022-07-11 |
| sigma |
Use of OpenConsole |
test |
2022-06-16 |
| sigma |
Atlassian Confluence CVE-2022-26134 |
test |
2022-06-03 |
| sigma |
Python Spawning Pretty TTY on Windows |
test |
2022-06-03 |
| sigma |
Suspicious Java Children Processes |
test |
2022-06-03 |
| sigma |
REvil Kaseya Incident Malware Patterns |
test |
2022-05-20 |
| elastic |
Linux Restricted Shell Breakout via the SSH command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via apt/apt-get Changelog Escape |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via awk Commands |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via busybox Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via c89/c99 Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via cpulimit Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via crash Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via env Shell Evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the expect command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the find command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via flock Shell evasion |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the gcc command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the vi command |
deprecated |
2022-05-09 |
| elastic |
Linux Restricted Shell Breakout via the mysql command |
deprecated |
2022-05-09 |
| sigma |
Suspicious Scan Loop Network |
test |
2022-03-12 |
| sigma |
Writing Of Malicious Files To The Fonts Folder |
test |
2022-03-08 |
| sigma |
Suspicious RASdial Activity |
test |
2021-11-27 |
| sigma |
Sysprep on AppData Folder |
test |
2021-11-27 |
| sigma |
Run PowerShell Script from Redirected Input Stream |
test |
2021-11-27 |
| elastic |
PowerShell spawning Cmd |
deprecated |
2021-04-15 |
| sigma |
Windows Defender Threat Detected |
stable |
2020-07-28 |
| sentinel |
Midnight Blizzard - Script payload stored in Registry |
Scheduled |
— |
| sentinel |
Base64 encoded Windows process command-lines (Normalized Process Events) |
Scheduled |
— |
| sentinel |
SUNBURST suspicious SolarWinds child processes (Normalized Process Events) |
Scheduled |
— |
| sentinel |
PHP Worker Process Spawning Shell/Recon Tool |
Scheduled |
— |
| sentinel |
Application Gateway WAF - SQLi Detection |
Scheduled |
— |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
SUNBURST and SUPERNOVA backdoor hashes (Normalized File Events) |
Scheduled |
— |