| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| splunk |
HTTP POST Request with Encoded Payload |
production |
2026-10-19 |
| splunk |
Unusual HTTP Request Method |
production |
2026-10-12 |
| splunk |
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script |
production |
2026-10-09 |
| splunk |
Cisco Secure Firewall - Connection to File Sharing Domain |
production |
2026-10-08 |
| splunk |
Windows Non-System Process Querying Definition Update |
production |
2026-10-08 |
| elastic |
Cobalt Strike Command and Control Beacon |
production |
2026-10-06 |
| elastic |
Possible FIN7 DGA Command and Control Behavior |
production |
2026-10-06 |
| elastic |
Halfbaked Command and Control Beacon |
production |
2026-10-06 |
| sigma |
Bitsadmin to Uncommon TLD |
test |
2026-09-30 |
| elastic |
Anthropic Activity from a Suspicious User Agent |
production |
2026-09-25 |
| elastic |
GenAI Process Connection to Unusual Domain |
production |
2026-09-25 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| splunk |
HTTP RMM User Agent |
production |
2026-09-22 |
| splunk |
HTTP Malware User Agent |
production |
2026-09-22 |
| splunk |
HTTP C2 Framework User Agent |
production |
2026-09-22 |
| splunk |
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint |
production |
2026-09-22 |
| splunk |
Cisco NVM - Osascript Network Connection for a Long Duration |
production |
2026-09-22 |
| splunk |
HTTP Scripting Tool User Agent |
production |
2026-09-22 |
| splunk |
HTTP PUA User Agent |
production |
2026-09-22 |
| elastic |
Simple HTTP Web Server Creation |
production |
2026-09-18 |
| elastic |
Simple HTTP Web Server Connection |
production |
2026-09-18 |
| elastic |
Network Connection Followed by File Creation |
production |
2026-09-18 |
| elastic |
Git Repository or File Download to Suspicious Directory |
production |
2026-09-18 |
| elastic |
Linux Telegram API Request |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
File Download Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Curl or Wget Spawned via Node.js |
production |
2026-09-18 |
| elastic |
Potential Tunneling via AWS IoT Secure Tunneling Localproxy |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Unusual Network Connection via RunDLL32 |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Curl for Windows |
production |
2026-09-18 |
| elastic |
Outlook Home Page Registry Modification |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Certreq |
production |
2026-09-18 |
| elastic |
Default Cobalt Strike Team Server Certificate |
production |
2026-09-18 |
| elastic |
Unusual Network Destination Domain Name |
production |
2026-09-18 |
| elastic |
Unusual Web User Agent |
production |
2026-09-18 |
| elastic |
Unusual Web Request |
production |
2026-09-18 |
| elastic |
Suspicious Installer Package Spawns Network Event |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Web Service |
production |
2026-09-18 |
| elastic |
Unusual Network Connection to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Suspicious Curl from macOS Application |
production |
2026-09-18 |
| elastic |
Perl Outbound Network Connection |
production |
2026-09-18 |
| elastic |
Deprecated - SUNBURST Command and Control Activity |
deprecated |
2026-08-19 |
| splunk |
HTTP Request to Reserved Name on IIS Server |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - High EVE Threat Confidence |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Wget or Curl Download |
production |
2026-05-13 |
| splunk |
HTTP Duplicated Header |
production |
2026-05-13 |
| splunk |
HTTP Possible Request Smuggling |
production |
2026-05-13 |
| splunk |
HTTP Rapid POST with Mixed Status Codes |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack DNS Indicators |
experimental |
2026-05-12 |
| sigma |
Axios NPM Compromise Malicious C2 Domain DNS Query |
experimental |
2026-04-01 |
| elastic |
Deprecated - Potential Non-Standard Port HTTP/HTTPS connection |
deprecated |
2026-02-04 |
| sigma |
Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Renamed Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Change User Agents with WebRequest |
test |
2025-07-18 |
| sigma |
Katz Stealer Suspicious User-Agent |
experimental |
2025-05-22 |
| sigma |
Kalambur Backdoor Curl TOR SOCKS Proxy Execution |
experimental |
2025-02-11 |
| sigma |
Exploit Framework User Agent |
test |
2025-01-18 |
| sigma |
DNS Query Request By QuickAssist.EXE |
experimental |
2024-12-19 |
| sigma |
Outbound Network Connection Initiated By Microsoft Dialer |
test |
2024-04-26 |
| sigma |
Malware User Agent |
test |
2024-04-14 |
| sigma |
HackTool - Empire UserAgent URI Combo |
test |
2024-02-26 |
| sigma |
ComRAT Network Communication |
test |
2024-02-26 |
| sigma |
HackTool - BabyShark Agent Default URL Pattern |
test |
2024-02-15 |
| sigma |
APT User Agent |
test |
2024-02-15 |
| sigma |
Chafer Malware URL Pattern |
test |
2024-02-15 |
| sigma |
HackTool - CobaltStrike Malleable Profile Patterns - Proxy |
test |
2024-02-15 |
| sigma |
Tunneling Tool Execution |
test |
2024-01-18 |
| sigma |
Cloudflared Tunnels Related DNS Requests |
test |
2023-12-20 |
| sigma |
DNS Query To Visual Studio Code Tunnels Domain |
test |
2023-11-20 |
| sigma |
DNS Query To Devtunnels Domain |
test |
2023-11-20 |
| sigma |
Visual Studio Code Tunnel Service Installation |
test |
2023-10-25 |
| sigma |
Visual Studio Code Tunnel Shell Execution |
test |
2023-10-25 |
| sigma |
APT40 Dropbox Tool User Agent |
test |
2023-05-18 |
| sigma |
Telegram API Access |
test |
2023-05-18 |
| sigma |
Suspicious Base64 Encoded User-Agent |
test |
2023-05-04 |
| sigma |
Potential Base64 Encoded User-Agent |
test |
2023-05-04 |
| sigma |
Curl.EXE Execution With Custom UserAgent |
test |
2023-02-21 |
| sigma |
Suspicious Installer Package Child Process |
test |
2023-02-18 |
| sigma |
Raw Paste Service Access |
test |
2023-01-19 |
| sigma |
Suspicious User Agent |
test |
2022-10-31 |
| sigma |
Suspicious Curl Change User Agents - Linux |
test |
2022-09-15 |
| sigma |
Bitsadmin to Uncommon IP Server Address |
test |
2022-08-24 |
| sigma |
Ursnif Malware Download URL Pattern |
stable |
2022-08-15 |
| sigma |
Wannacry Killswitch Domain |
test |
2022-03-24 |
| sigma |
HTTP Request With Empty User Agent |
test |
2021-11-27 |
| sigma |
Windows PowerShell User Agent |
test |
2021-11-27 |
| sigma |
Windows WebDAV User Agent |
test |
2021-11-27 |
| sigma |
Crypto Miner User Agent |
test |
2021-11-27 |
| sigma |
PwnDrp Access |
test |
2021-11-27 |
| sigma |
Ursnif Malware C2 URL Pattern |
stable |
2021-08-09 |
| sentinel |
Windows host username encoded in base64 web request |
Scheduled |
— |
| sentinel |
RunningRAT request parameters |
Scheduled |
— |
| sentinel |
Discord CDN Risky File Download (ASIM Web Session Schema) |
Scheduled |
— |
| sentinel |
IP address of Windows host encoded in web request |
Scheduled |
— |