| sigma |
AppLocker Application Would Have Been Blocked |
experimental |
2026-10-20 |
| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Suspicious React Server Child Process |
production |
2026-10-09 |
| elastic |
Cloud Offensive Framework Execution |
production |
2026-10-08 |
| elastic |
First Time GCP Vertex AI Agent Engine Sandbox Code Execution by User and Source ASN |
production |
2026-10-06 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-10-06 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
First Time Python Spawned a Shell on Host |
production |
2026-09-29 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| splunk |
Windows Renamed Python Binary was Executed |
production |
2026-09-23 |
| elastic |
Potential Privilege Escalation via Python cap_setuid |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Python Site or User Customize File Creation |
production |
2026-09-18 |
| elastic |
Suspicious UID Change to Root via Python |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Suspicious Browser Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Unusual Library Load via Python |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Suspicious Emond Child Process |
production |
2026-09-18 |
| elastic |
Execution with Explicit Credentials via Scripting |
production |
2026-09-18 |
| elastic |
ROT Encoded Python Script Execution |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Potential Java Service Exploitation via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution by Zoom |
production |
2026-09-18 |
| elastic |
Suspicious Python Shell Command Execution |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Payload Execution via Shell Pipe Detected by Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Interactive Terminal Spawned via Python |
production |
2026-09-18 |
| elastic |
Web Server Spawned via Python |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Potential Reverse Shell via UDP |
production |
2026-09-18 |
| elastic |
Suspicious APT Package Manager Execution |
production |
2026-09-18 |
| elastic |
Process Spawned from Message-of-the-Day (MOTD) |
production |
2026-09-18 |
| elastic |
Python Path File (pth) Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| splunk |
Python Network Traffic During Package Build |
production |
2026-08-21 |
| elastic |
Deprecated - EggShell Backdoor Execution |
deprecated |
2026-07-02 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
Axios NPM Compromise Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Python One-Liners with Base64 Decoding - Linux |
experimental |
2026-03-09 |
| sigma |
Python One-Liners with Base64 Decoding |
experimental |
2026-03-09 |
| sigma |
AppLocker Prevented Application or Script from Running |
test |
2025-12-03 |
| sigma |
Emotet Loader Execution Via .LNK File |
test |
2024-08-15 |
| sigma |
Python Path Configuration File Creation - Windows |
test |
2024-04-25 |
| sigma |
Python Path Configuration File Creation - MacOS |
test |
2024-04-25 |
| sigma |
Python Path Configuration File Creation - Linux |
test |
2024-04-25 |
| sigma |
Suspicious File Characteristics Due to Missing Fields |
test |
2022-10-09 |
| sigma |
Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution |
test |
2022-04-25 |
| sigma |
Serpent Backdoor Payload Execution Via Scheduled Task |
test |
2022-03-21 |