| elastic |
Web Shell Detection: Script Process Child of Common Web Processes |
production |
2026-10-23 |
| sigma |
AppLocker Application Would Have Been Blocked |
experimental |
2026-10-20 |
| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| splunk |
Vbscript Execution Using Wscript App |
production |
2026-10-09 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-10-09 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-10-08 |
| splunk |
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI |
production |
2026-09-22 |
| splunk |
Cisco NVM - Susp Script From Archive Triggering Network Activity |
production |
2026-09-22 |
| elastic |
Microsoft Management Console File from Unusual Path |
production |
2026-09-18 |
| elastic |
Windows Script Execution from Archive |
production |
2026-09-18 |
| elastic |
Command and Scripting Interpreter via Windows Scripts |
production |
2026-09-18 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Service Control Spawned via Script Interpreter |
production |
2026-09-18 |
| elastic |
Scheduled Task Created by a Windows Script |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| elastic |
Suspicious Explorer Child Process |
production |
2026-09-18 |
| elastic |
Windows Script Interpreter Executing Process via WMI |
production |
2026-09-18 |
| elastic |
Windows Script Executing PowerShell |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| splunk |
Suspicious Process With Discord DNS Query |
production |
2026-06-25 |
| splunk |
Windows Outlook Macro Created by Suspicious Process |
production |
2026-05-13 |
| splunk |
Suspicious Process DNS Query Known Abuse Web Services |
production |
2026-05-13 |
| splunk |
Execute Javascript With Jscript COM CLSID |
production |
2026-05-13 |
| sigma |
Registry Tampering by Potentially Suspicious Processes |
experimental |
2026-04-14 |
| sigma |
HackTool - NetExec File Indicators |
experimental |
2026-04-08 |
| sigma |
Axios NPM Compromise Indicators - Windows |
experimental |
2026-04-01 |
| sigma |
Csc.EXE Execution Form Potentially Suspicious Parent |
test |
2026-03-23 |
| sigma |
Potential Dropper Script Execution Via WScript/CScript/MSHTA |
test |
2026-02-17 |
| sigma |
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript |
test |
2026-02-17 |
| sigma |
WScript or CScript Dropper - File |
test |
2026-02-17 |
| sigma |
XSL Script Execution Via WMIC.EXE |
test |
2026-01-24 |
| sigma |
Potential Remote SquiblyTwo Technique Execution |
test |
2026-01-24 |
| sigma |
AppLocker Prevented Application or Script from Running |
test |
2025-12-03 |
| sigma |
Registry Modification Attempt Via VBScript |
experimental |
2025-08-13 |
| sigma |
Registry Modification Attempt Via VBScript - PowerShell |
experimental |
2025-08-13 |
| sigma |
MMC Loading Script Engines DLLs |
experimental |
2025-02-05 |
| sigma |
Suspicious Scripting in a WMI Consumer |
test |
2023-09-09 |
| sigma |
Uncommon Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
Suspicious Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
Cscript/Wscript Uncommon Script Extension Execution |
test |
2023-06-19 |
| sigma |
Windows Shell/Scripting Processes Spawning Suspicious Programs |
test |
2023-05-23 |
| sigma |
HackTool - CACTUSTORCH Remote Thread Creation |
test |
2023-05-05 |
| sigma |
HTML Help HH.EXE Suspicious Child Process |
test |
2023-04-12 |
| sigma |
Suspicious HH.EXE Execution |
test |
2023-04-12 |
| sigma |
Potential APT10 Cloud Hopper Activity |
test |
2023-03-08 |
| sigma |
HackTool - Koadic Execution |
test |
2023-02-11 |
| sigma |
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS |
test |
2023-02-08 |
| sigma |
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS |
test |
2023-02-08 |
| sigma |
Potential QBot Activity |
stable |
2023-02-03 |
| sigma |
Adwind RAT / JRAT File Artifact |
test |
2022-12-02 |
| sigma |
Adwind RAT / JRAT |
test |
2022-10-09 |