| elastic |
Web Shell Detection: Script Process Child of Common Web Processes |
production |
2026-10-23 |
| sigma |
AppLocker Application Would Have Been Blocked |
experimental |
2026-10-20 |
| splunk |
Jscript Execution Using Cscript App |
production |
2026-10-09 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-10-09 |
| elastic |
Suspicious React Server Child Process |
production |
2026-10-09 |
| elastic |
Potential Prompt Injection Coercing Shell Execution |
production |
2026-10-09 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-10-08 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-10-06 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| splunk |
MacOS Osascript Executing JavaScript Code With ObjC |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver WebShell Creation |
production |
2026-09-18 |
| elastic |
Potential SAP NetWeaver Exploitation |
production |
2026-09-18 |
| elastic |
Potential Java Service Exploitation via Suspicious Child Process |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Suspicious AWS S3 Connection via Script Interpreter |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Script Interpreter Connection to Non-Standard Port |
production |
2026-09-18 |
| elastic |
Execution via Electron Child Process Node.js Module |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Suspicious Automator Workflows Execution |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Jamf Endpoint |
production |
2026-09-18 |
| elastic |
Cassandra JavaScript UDF Creation |
production |
2026-09-18 |
| elastic |
React2Shell (CVE-2025-55182) Exploitation Attempt |
production |
2026-09-18 |
| elastic |
React2Shell Network Security Alert |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Suspicious Execution with NodeJS |
production |
2026-09-18 |
| elastic |
Command and Scripting Interpreter via Windows Scripts |
production |
2026-09-18 |
| elastic |
Windows Script Execution from Archive |
production |
2026-09-18 |
| elastic |
Suspicious JavaScript Execution via Deno |
production |
2026-09-18 |
| elastic |
Microsoft Management Console File from Unusual Path |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| elastic |
Windows Script Executing PowerShell |
production |
2026-09-18 |
| elastic |
Windows Script Interpreter Executing Process via WMI |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Remote XSL Script Execution via COM |
production |
2026-09-18 |
| splunk |
Windows Node.exe Executing JS Script In Immediate Folder |
production |
2026-09-16 |
| elastic |
Deprecated - Unusual Process Spawned from Web Server Parent |
deprecated |
2026-07-02 |
| splunk |
MS Scripting Process Loading WMI Module |
production |
2026-05-13 |
| splunk |
MS Scripting Process Loading Ldap Module |
production |
2026-05-13 |
| splunk |
Windows GrimResource - MMC Process Accessing APDS DLL |
production |
2026-05-13 |
| splunk |
Windows Cmdline Tool Execution From Non-Shell Process |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
Csc.EXE Execution Form Potentially Suspicious Parent |
test |
2026-03-23 |
| sigma |
Potential Dropper Script Execution Via WScript/CScript/MSHTA |
test |
2026-02-17 |
| sigma |
WScript or CScript Dropper - File |
test |
2026-02-17 |
| sigma |
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript |
test |
2026-02-17 |
| sigma |
New Agent Skills Installation Attempt Via Node.EXE |
experimental |
2026-02-03 |
| sigma |
Potential Remote SquiblyTwo Technique Execution |
test |
2026-01-24 |
| sigma |
XSL Script Execution Via WMIC.EXE |
test |
2026-01-24 |
| sigma |
AppLocker Prevented Application or Script from Running |
test |
2025-12-03 |
| sigma |
Script Interpreter Spawning Credential Scanner - Windows |
experimental |
2025-11-25 |
| sigma |
Suspicious Deno File Written from Remote Source |
experimental |
2025-05-22 |
| sigma |
MSHTA Execution with Suspicious File Extensions |
test |
2025-05-12 |
| sigma |
Potentially Suspicious Inline JavaScript Execution via NodeJS Binary |
experimental |
2025-04-21 |
| sigma |
NodeJS Execution of JavaScript File |
experimental |
2025-04-21 |
| elastic |
Deprecated - Suspicious JAVA Child Process |
deprecated |
2025-01-17 |
| sigma |
Potential In-Memory Download And Compile Of Payloads |
test |
2023-08-22 |
| sigma |
Cscript/Wscript Uncommon Script Extension Execution |
test |
2023-06-19 |
| sigma |
HackTool - CACTUSTORCH Remote Thread Creation |
test |
2023-05-05 |
| sigma |
Suspicious HH.EXE Execution |
test |
2023-04-12 |
| sigma |
HTML Help HH.EXE Suspicious Child Process |
test |
2023-04-12 |
| sigma |
Suspicious Installer Package Child Process |
test |
2023-02-18 |
| sigma |
HackTool - Koadic Execution |
test |
2023-02-11 |
| sigma |
JXA In-memory Execution Via OSAScript |
test |
2023-01-31 |
| sigma |
Adwind RAT / JRAT File Artifact |
test |
2022-12-02 |
| sigma |
Adwind RAT / JRAT |
test |
2022-10-09 |
| sigma |
Node Process Executions |
test |
2022-04-06 |