| elastic |
Suspicious SolarWinds Web Help Desk Java Module Load or Child Process |
production |
2026-10-09 |
| elastic |
Suspicious Execution via Microsoft Office Add-Ins |
production |
2026-10-06 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
Unusual Library Load via Python |
production |
2026-09-18 |
| elastic |
ImageLoad via Windows Update Auto Update Client |
production |
2026-09-18 |
| elastic |
WPS Office Exploitation via DLL Hijack |
production |
2026-09-18 |
| elastic |
Execution via local SxS Shared Module |
production |
2026-09-18 |
| elastic |
Unsigned DLL loaded by DNS Service |
production |
2026-09-18 |
| sigma |
Unsigned .node File Loaded |
experimental |
2026-08-27 |
| splunk |
Linux Suspicious GCC Invocation Building Init Shared Object |
production |
2026-07-08 |
| splunk |
Windows PowerShell Module File Created |
production |
2026-05-13 |
| splunk |
Windows PowerShell Script TabExpansion Direct Call |
production |
2026-05-13 |
| splunk |
Windows Remote Image Load |
production |
2026-05-13 |
| splunk |
Windows XLL File Creation Outside of Typical Location |
production |
2026-05-13 |
| splunk |
Windows Executable in Loaded Modules |
production |
2026-05-13 |
| sigma |
Katz Stealer DLL Loaded |
experimental |
2025-05-22 |