| sigma |
Shai-Hulud 2.0 Malicious NPM Package Installation - Linux |
experimental |
2026-10-19 |
| elastic |
Suspicious SolarWinds Child Process |
production |
2026-10-06 |
| elastic |
Command Execution via SolarWinds Process |
production |
2026-10-06 |
| elastic |
SolarWinds Process Disabling Services via Registry |
production |
2026-10-06 |
| elastic |
Elastic Defend Alert from GenAI Utility or Descendant |
production |
2026-09-25 |
| splunk |
3CX Supply Chain Attack Network Indicators |
production |
2026-09-22 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
GitHub Actions Unusual Bot Push to Repository |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert from Package Manager Install Ancestry |
production |
2026-09-18 |
| elastic |
Remote GitHub Actions Runner Registration |
production |
2026-09-18 |
| elastic |
Execution via GitHub Actions Runner |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
RPM Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
Unusual DPKG Execution |
production |
2026-09-18 |
| elastic |
DPKG Package Installed by Unusual Parent Process |
production |
2026-09-18 |
| elastic |
New GitHub Self Hosted Action Runner |
production |
2026-09-18 |
| splunk |
Python PYTHONPATH Modification During Package Installation |
production |
2026-08-21 |
| splunk |
Python Network Traffic During Package Build |
production |
2026-08-21 |
| splunk |
Python PTH File Creation During Package Installation |
production |
2026-08-21 |
| splunk |
Python Site Hooks Creation During Package Installation |
production |
2026-08-21 |
| elastic |
Deprecated - SUNBURST Command and Control Activity |
deprecated |
2026-08-19 |
| splunk |
Shai-Hulud 2 Exfiltration Artifact Files |
production |
2026-05-13 |
| splunk |
Windows Vulnerable 3CX Software |
production |
2026-05-13 |
| splunk |
Hunting 3CXDesktopApp Software |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
Axios NPM Compromise File Creation Indicators - MacOS |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - Windows |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - Windows |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - macOS |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators |
experimental |
2026-03-30 |
| sigma |
LiteLLM / TeamPCP Supply Chain Attack Indicators |
experimental |
2026-03-30 |
| sigma |
Notepad++ Updater DNS Query to Uncommon Domains |
experimental |
2026-03-16 |
| sigma |
Uncommon File Created by Notepad++ Updater Gup.EXE |
experimental |
2026-03-16 |
| sigma |
Suspicious Child Process of Notepad++ Updater - GUP.Exe |
experimental |
2026-02-03 |
| sigma |
Shai-Hulud 2.0 Malicious NPM Package Installation |
experimental |
2025-11-28 |
| sigma |
Shai-Hulud Malicious Bun Execution |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malicious Bun Execution - Linux |
experimental |
2025-11-25 |