| splunk |
Web or Application Server Spawning a Shell |
production |
2026-10-28 |
| elastic |
AWS EKS Exposed Service Created With Type NodePort |
production |
2026-10-21 |
| elastic |
Potential SSH Brute Force Detected via macOS Security Events |
production |
2026-10-06 |
| elastic |
Ollama API Accessed from External Network |
production |
2026-09-25 |
| elastic |
RPC (Remote Procedure Call) from the Internet |
production |
2026-09-21 |
| elastic |
Accepted Default Telnet Port Connection |
production |
2026-09-21 |
| elastic |
SMB (Windows File Sharing) Activity from the Internet |
production |
2026-09-21 |
| elastic |
Potential macOS SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
First Occurrence of Okta User Session Started via Proxy |
production |
2026-09-18 |
| elastic |
Kubernetes Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
GKE Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
AWS RDS DB Instance Made Public |
production |
2026-09-18 |
| elastic |
AWS Lambda Function URL Created with Public Access |
production |
2026-09-18 |
| elastic |
First Seen SonicWall Remote Access Login by User and Source |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
VNC (Virtual Network Computing) from the Internet |
production |
2026-09-18 |
| elastic |
RDP (Remote Desktop Protocol) from the Internet |
production |
2026-09-18 |
| elastic |
Virtual Private Network Connection Attempt |
production |
2026-09-18 |
| elastic |
Remote SSH Login Enabled via systemsetup Command |
production |
2026-09-18 |
| elastic |
Insecure AWS EC2 VPC Security Group Ingress Rule Added |
production |
2026-09-18 |
| elastic |
AWS EC2 Network Access Control List Creation |
production |
2026-09-18 |
| elastic |
AWS EC2 Security Group Configuration Change |
production |
2026-09-18 |
| elastic |
Zoom Meeting with no Passcode |
production |
2026-09-18 |
| elastic |
AWS SSM Agent Registered via Hybrid Activation |
production |
2026-09-14 |
| splunk |
Log4Shell JNDI Payload Injection Attempt |
production |
2026-09-08 |
| splunk |
Log4Shell JNDI Payload Injection with Outbound Connection |
production |
2026-09-08 |
| splunk |
Web Spring4Shell HTTP Request Class Module |
production |
2026-05-13 |
| splunk |
Web Spring Cloud Function FunctionRouter |
production |
2026-05-13 |
| splunk |
Windows Exchange Autodiscover SSRF Abuse |
production |
2026-05-13 |
| splunk |
Web JSP Request via URL |
production |
2026-05-13 |
| splunk |
Detect Exchange Web Shell |
production |
2026-05-13 |
| splunk |
Exchange PowerShell Abuse via SSRF |
experimental |
2026-05-13 |
| splunk |
Java Writing JSP File |
production |
2026-05-13 |
| splunk |
Living Off The Land Detection |
production |
2026-05-13 |
| splunk |
Log4Shell CVE-2021-44228 Exploitation |
production |
2026-05-13 |
| splunk |
MS Exchange Mailbox Replication service writing Active Server Pages |
experimental |
2026-05-13 |
| splunk |
Outbound Network Connection from Java Using Default Ports |
production |
2026-05-13 |
| splunk |
PaperCut NG Suspicious Behavior Debug Log |
production |
2026-05-13 |
| splunk |
Windows MOVEit Transfer Writing ASPX |
production |
2026-05-13 |
| splunk |
Windows PaperCut NG Spawn Shell |
production |
2026-05-13 |
| splunk |
Windows RDPClient Connection Sequence Events |
production |
2026-05-13 |
| splunk |
Cisco Network Interface Modifications |
production |
2026-05-13 |
| splunk |
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 |
production |
2026-05-13 |
| splunk |
Confluence Unauthenticated Remote Code Execution CVE-2022-26134 |
production |
2026-05-13 |
| splunk |
Detect attackers scanning for vulnerable JBoss servers |
experimental |
2026-05-13 |
| splunk |
Exploit Public Facing Application via Apache Commons Text |
production |
2026-05-13 |
| splunk |
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 |
production |
2026-05-13 |
| splunk |
Fortinet Appliance Auth bypass |
production |
2026-05-13 |
| splunk |
Hunting for Log4Shell |
production |
2026-05-13 |
| splunk |
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078 |
production |
2026-05-13 |
| splunk |
Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082 |
production |
2026-05-13 |
| splunk |
PaperCut NG Remote Web Access Attempt |
production |
2026-05-13 |
| splunk |
ProxyShell ProxyNotShell Behavior Detected |
production |
2026-05-13 |
| splunk |
Spring4Shell Payload URL Request |
production |
2026-05-13 |
| splunk |
Supernova Webshell |
experimental |
2026-05-13 |
| splunk |
VMWare Aria Operations Exploit Attempt |
production |
2026-05-13 |
| splunk |
VMware Server Side Template Injection Hunt |
production |
2026-05-13 |
| splunk |
VMware Workspace ONE Freemarker Server-side Template Injection |
production |
2026-05-13 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container via Elastic Defend |
deprecated |
2026-02-04 |
| elastic |
Deprecated - AWS RDS Cluster Creation |
deprecated |
2026-01-16 |
| sigma |
OpenCanary - RDP New Connection Attempt |
experimental |
2026-01-06 |
| sigma |
Suspicious File Created by ArcSOC.exe |
experimental |
2025-11-25 |
| sigma |
FortiGate - VPN SSL Settings Modified |
experimental |
2025-11-01 |
| sigma |
FortiGate - New VPN SSL Web Portal Added |
experimental |
2025-11-01 |
| sigma |
Potential Exploitation of GoAnywhere MFT Vulnerability |
experimental |
2025-10-07 |
| elastic |
Deprecated - SSH Connection Established Inside A Running Container |
deprecated |
2025-03-14 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container |
deprecated |
2025-03-14 |
| sigma |
Failed Logon From Public IP |
test |
2024-03-11 |
| sigma |
Remote Access Tool - Team Viewer Session Started On Linux Host |
test |
2024-03-11 |
| sigma |
Remote Access Tool - Team Viewer Session Started On Windows Host |
test |
2024-03-11 |
| sigma |
Remote Access Tool - Team Viewer Session Started On MacOS Host |
test |
2024-03-11 |
| sigma |
External Remote RDP Logon from Public IP |
test |
2024-03-11 |
| sigma |
External Remote SMB Logon from Public IP |
test |
2024-03-11 |
| sigma |
OpenCanary - SSH Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - Telnet Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - SSH New Connection Attempt |
test |
2024-03-08 |
| sigma |
Remote Access Tool - ScreenConnect Installation Execution |
test |
2024-02-26 |
| sigma |
Running Chrome VPN Extensions via the Registry 2 VPN Extension |
test |
2023-08-17 |
| sigma |
Unusual File Deletion by Dns.exe |
test |
2023-02-15 |
| sigma |
Unusual Child Process of dns.exe |
test |
2023-02-05 |
| sigma |
Unusual File Modification by dns.exe |
test |
2022-09-27 |
| sigma |
User Added to Remote Desktop Users Group |
test |
2022-09-09 |