| elastic |
Connection to Commonly Abused Web Services |
production |
2026-10-19 |
| elastic |
Connection to Common Large Language Model Endpoints |
production |
2026-10-09 |
| splunk |
Windows DNS Query Request by Telegram Bot API |
production |
2026-10-06 |
| elastic |
AWS CLI Command with Custom Endpoint URL |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity with High Confidence |
production |
2026-09-18 |
| elastic |
Unusual DNS Request to Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Linux Telegram API Request |
production |
2026-09-18 |
| elastic |
Potential EtherHiding C2 via Curl JSON-RPC Request |
production |
2026-09-18 |
| elastic |
Google Calendar C2 via Script Interpreter |
production |
2026-09-18 |
| elastic |
Potential Etherhiding C2 via Blockchain Connection |
production |
2026-09-18 |
| elastic |
Suspicious Curl to Google App Script Endpoint |
production |
2026-09-18 |
| elastic |
Statistical Model Detected C2 Beaconing Activity |
production |
2026-09-18 |
| splunk |
Potential Telegram API Request Via CommandLine |
production |
2026-05-13 |
| sigma |
Github Self-Hosted Runner Execution |
test |
2025-11-29 |
| sigma |
Potentially Suspicious Azure Front Door Connection |
test |
2024-11-07 |
| sigma |
Telegram API Access |
test |
2023-05-18 |
| sigma |
Telegram Bot API Request |
test |
2022-10-09 |
| sentinel |
CreepyDrive URLs |
Scheduled |
— |
| sentinel |
CreepyDrive request URL sequence |
Scheduled |
— |