| elastic |
Suspicious SolarWinds Child Process |
production |
2026-10-06 |
| elastic |
LSASS Process Access via Windows API |
production |
2026-09-22 |
| elastic |
Abnormal Process ID or Lock File Created |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Audio Capture Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Keylogging Script |
production |
2026-09-18 |
| elastic |
PowerShell Kerberos Ticket Dump |
production |
2026-09-18 |
| elastic |
Potential Credential Access via LSASS Memory Dump |
production |
2026-09-18 |
| elastic |
Potential Process Injection via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Process Access via Direct System Call |
production |
2026-09-18 |
| elastic |
PowerShell Share Enumeration Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Discovery Related Windows API Functions |
production |
2026-09-18 |
| elastic |
PowerShell PSReflect Script |
production |
2026-09-18 |
| elastic |
Persistence via Hidden Run Key Detected |
production |
2026-09-18 |
| elastic |
PowerShell Script with Token Impersonation Capabilities |
production |
2026-09-18 |
| elastic |
Potential Fileless Execution via Unusual memfd Create Call |
production |
2026-09-08 |
| sigma |
Potential WinAPI Calls Via PowerShell Scripts |
test |
2026-04-29 |
| sigma |
BPFDoor Abnormal Process ID or Lock File Accessed |
test |
2026-03-30 |
| sigma |
Potential WinAPI Calls Via CommandLine |
test |
2025-03-06 |
| sigma |
Potential Binary Proxy Execution Via Cdb.EXE |
test |
2024-04-22 |
| sigma |
Potential Direct Syscall of NtOpenProcess |
test |
2023-12-13 |
| sigma |
HackTool - WinPwn Execution |
test |
2023-12-04 |
| sigma |
HackTool - WinPwn Execution - ScriptBlock |
test |
2023-12-04 |
| sigma |
HackTool - CobaltStrike BOF Injection Pattern |
test |
2023-11-28 |
| sigma |
HackTool - HandleKatz Duplicating LSASS Handle |
test |
2023-11-28 |
| sigma |
WinAPI Library Calls Via PowerShell Scripts |
test |
2023-07-21 |
| sigma |
WinAPI Function Calls Via PowerShell Scripts |
test |
2023-07-21 |
| sigma |
HackTool - RedMimicry Winnti Playbook Execution |
test |
2023-03-01 |
| sigma |
Suspicious Mshta.EXE Execution Patterns |
test |
2023-02-21 |
| sigma |
Turla Group Named Pipes |
test |
2021-11-27 |
| sentinel |
Suspicious VM Instance Creation Activity Detected |
Scheduled |
— |