| elastic |
Suspicious Windows Powershell Arguments |
production |
2026-10-19 |
| elastic |
Potential PowerShell Obfuscated Script via High Entropy |
production |
2026-10-19 |
| elastic |
Suspicious Content Extracted or Decompressed via Funzip |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-10-09 |
| elastic |
Long Base64 Encoded Command via Scripting Interpreter |
production |
2026-10-06 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
PowerShell Obfuscation via Negative Index String Reversal |
production |
2026-10-05 |
| splunk |
CertUtil With Decode Argument |
production |
2026-10-02 |
| elastic |
Execution via OpenClaw Agent |
production |
2026-09-25 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
ROT Encoded Python Script Execution |
production |
2026-09-18 |
| elastic |
Command Line Obfuscation via Whitespace Padding |
production |
2026-09-18 |
| elastic |
Web Server Potential Command Injection Request |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Interpreter Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Suspicious Echo or Printf Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
Kernel Unpacking Activity |
production |
2026-09-18 |
| elastic |
Suspicious Execution from Foomatic-rip or Cupsd Parent |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Payload Encoded and Compressed |
production |
2026-09-18 |
| elastic |
PowerShell Script with Encryption/Decryption Capabilities |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Invalid Escape Sequences |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Character Array Reconstruction |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |
| elastic |
Potential Dynamic IEX Reconstruction via Environment Variables |
production |
2026-09-18 |
| elastic |
Dynamic IEX Reconstruction via Method String Access |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Reverse Keywords |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Concatenation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Reordering |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Special Character Overuse |
production |
2026-09-18 |
| elastic |
Suspicious CertUtil Commands |
production |
2026-09-18 |
| elastic |
Deprecated - Potential PowerShell Obfuscated Script |
deprecated |
2026-08-19 |
| elastic |
Deprecated - Encoded Executable Stored in the Registry |
deprecated |
2026-08-19 |
| splunk |
Linux Auditd Base64 Decode Files |
production |
2026-05-13 |
| sigma |
Ping Hex IP |
test |
2025-10-17 |
| sigma |
MSHTA Execution with Suspicious File Extensions |
test |
2025-05-12 |
| suricata |
ET MALWARE PLATINUM Steganographic HTTP Response Page Inbound |
rev 4 |
2024-03-07 |
| sigma |
Potential Base64 Decoded From Images |
test |
2023-12-20 |
| sigma |
Suspicious Inbox Manipulation Rules |
test |
2023-09-03 |
| sigma |
DNS-over-HTTPS Enabled by Registry |
test |
2023-08-17 |
| sigma |
Linux Base64 Encoded Pipe to Shell |
test |
2023-06-16 |
| sigma |
UNC4841 - Download Compressed Files From Temp.sh Using Wget |
test |
2023-06-16 |
| sigma |
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget |
test |
2023-06-16 |
| sigma |
UNC4841 - SSL Certificate Exfiltration Via Openssl |
test |
2023-06-16 |
| sigma |
PowerShell Base64 Encoded FromBase64String Cmdlet |
test |
2023-04-06 |
| sigma |
Potential Commandline Obfuscation Using Escape Characters |
test |
2023-03-03 |
| sigma |
Potential BlackByte Ransomware Activity |
test |
2023-02-08 |
| sigma |
Suspicious XOR Encoded PowerShell Command |
test |
2023-01-30 |
| sigma |
Base64 Encoded PowerShell Command Detected |
test |
2023-01-26 |
| sigma |
PowerShell Decompress Commands |
test |
2022-12-25 |
| sigma |
Payload Decoded and Decrypted via Built-in Utilities |
test |
2022-10-17 |
| sigma |
Linux Base64 Encoded Shebang In CLI |
test |
2022-09-15 |
| sigma |
Linux Shell Pipe to Shell |
test |
2022-07-26 |
| elastic |
Base64 Encoding/Decoding Activity |
deprecated |
2021-04-15 |
| elastic |
Hex Encoding/Decoding Activity |
deprecated |
2021-04-15 |
| snort |
ET TROJAN PLATINUM Steganographic HTTP Response Page Inbound |
rev 2 |
2019-06-05 |
| sentinel |
Base64 encoded Windows process command-lines (Normalized Process Events) |
Scheduled |
— |
| sentinel |
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) |
Scheduled |
— |