| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-10-19 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-10-09 |
| splunk |
Suspicious microsoft workflow compiler usage |
production |
2026-10-02 |
| splunk |
Suspicious microsoft workflow compiler rename |
deprecated |
2026-09-23 |
| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
Unusual Process Network Connection |
production |
2026-09-18 |
| elastic |
Execution of Persistent Suspicious Program |
production |
2026-09-18 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| elastic |
Anomalous Linux Compiler Activity |
production |
2026-09-18 |
| elastic |
Potential Credential Access via Trusted Developer Utility |
production |
2026-09-18 |
| elastic |
Suspicious .NET Code Compilation |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a Script Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by a System Process |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Using an Alternate Name |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started an Unusual Process |
production |
2026-09-18 |
| elastic |
Process Injection by the Microsoft Build Engine |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| splunk |
ETW Registry Disabled |
production |
2026-05-13 |
| sigma |
Suspicious File Created by ArcSOC.exe |
experimental |
2025-11-25 |
| sigma |
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler |
test |
2025-02-24 |
| sigma |
AspNetCompiler Execution |
test |
2025-02-24 |
| sigma |
JScript Compiler Execution |
test |
2024-04-24 |
| sigma |
Potential Binary Proxy Execution Via Cdb.EXE |
test |
2024-04-22 |
| sigma |
Suspicious Child Process of AspNetCompiler |
test |
2023-08-14 |
| sigma |
Potential Mftrace.EXE Abuse |
test |
2023-08-03 |
| sigma |
Microsoft Workflow Compiler Execution |
test |
2023-02-03 |
| sigma |
Potential Arbitrary Code Execution Via Node.EXE |
test |
2023-02-03 |
| sigma |
Detection of PowerShell Execution via Sqlps.exe |
test |
2022-12-09 |
| sigma |
Kavremover Dropped Binary LOLBIN Usage |
test |
2022-11-01 |
| sigma |
Suspicious Use of CSharp Interactive Console |
test |
2022-07-14 |
| sigma |
Use of VSIISExeLauncher.exe |
test |
2022-06-09 |
| sigma |
Remote Thread Creation Ttdinject.exe Proxy |
test |
2022-06-02 |
| sigma |
Use of Remote.exe |
test |
2022-06-02 |
| sigma |
Use of Wfc.exe |
test |
2022-06-01 |
| sigma |
Use of TTDInject.exe |
test |
2022-05-16 |
| sigma |
C# IL Code Compilation Via Ilasm.EXE |
test |
2022-05-16 |
| sigma |
Node Process Executions |
test |
2022-04-06 |
| sigma |
SQL Client Tools PowerShell Session Detection |
test |
2022-02-25 |
| elastic |
Trusted Developer Application Usage |
deprecated |
2021-04-15 |