| splunk |
Windows Indirect Command Execution Via forfiles |
production |
2026-10-09 |
| splunk |
Windows Indirect Command Execution Via pcalua |
production |
2026-10-09 |
| elastic |
Proxy Execution via Console Window Host |
production |
2026-10-09 |
| elastic |
Suspicious Execution via Windows Subsystem for Linux |
production |
2026-10-06 |
| elastic |
Windows Subsystem for Linux Enabled via Dism Utility |
production |
2026-10-06 |
| splunk |
Windows Indirect Command Execution Via Series Of Forfiles |
production |
2026-10-02 |
| splunk |
Windows RunMRU Command Execution |
production |
2026-10-02 |
| sigma |
Uncommon Child Process Spawned From XBootMgrSleep.EXE |
experimental |
2026-09-27 |
| sigma |
Potential Arbitrary File Download Using Office Application |
test |
2026-09-25 |
| elastic |
Host File System Changes via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Curl or Wget Egress Network Connection via LoLBin |
production |
2026-09-18 |
| elastic |
System Binary Symlink to Suspicious Location |
production |
2026-09-18 |
| elastic |
Command Execution via ForFiles |
production |
2026-09-18 |
| elastic |
Proxy Execution via Windows OpenSSH |
production |
2026-09-18 |
| elastic |
Attempt to Install or Run Kali Linux via WSL |
production |
2026-09-18 |
| elastic |
Execution via Windows Subsystem for Linux |
production |
2026-09-18 |
| elastic |
Windows Subsystem for Linux Distribution Installed |
production |
2026-09-18 |
| elastic |
Privilege Escalation via Parallels Appliance Extract Argument Injection |
production |
2026-09-17 |
| splunk |
Windows Content Copied from Browser was Executed |
production |
2026-09-07 |
| elastic |
Deprecated - Linux Restricted Shell Breakout via Linux Binary(s) |
deprecated |
2026-07-02 |
| splunk |
Microsoft Intune Device Health Scripts |
production |
2026-05-13 |
| splunk |
Microsoft Intune Mobile Apps |
experimental |
2026-05-13 |
| sigma |
Indirect Command Execution via SFTP ProxyCommand |
experimental |
2026-04-27 |
| sigma |
WSL Kali-Linux Usage |
experimental |
2025-10-10 |
| sigma |
Proxy Execution via Vshadow |
experimental |
2025-05-26 |
| sigma |
Potential Binary Impersonating Sysinternals Tools |
test |
2025-04-12 |
| sigma |
Potentially Suspicious Child Processes Spawned by ConHost |
experimental |
2025-02-05 |
| sigma |
Renamed ZOHO Dctask64 Execution |
test |
2025-01-22 |
| sigma |
Suspicious High IntegrityLevel Conhost Legacy Option |
test |
2024-12-01 |
| sigma |
Renamed PAExec Execution |
test |
2024-11-23 |
| sigma |
Uncommon Child Process Of Setres.EXE |
test |
2024-06-26 |
| sigma |
Potential Arbitrary Command Execution Via FTP.EXE |
test |
2024-04-23 |
| sigma |
Potential Arbitrary File Download Via Cmdl32.EXE |
test |
2024-04-22 |
| sigma |
Potential Arbitrary Command Execution Using Msdt.EXE |
test |
2024-03-13 |
| sigma |
Suspicious Cabinet File Execution Via Msdt.EXE |
test |
2024-03-13 |
| sigma |
Renamed NirCmd.EXE Execution |
test |
2024-03-11 |
| sigma |
Findstr Launching .lnk File |
test |
2024-01-15 |
| sigma |
Renamed PingCastle Binary Execution |
test |
2024-01-11 |
| sigma |
Uncommon Child Process Of Conhost.EXE |
test |
2023-12-11 |
| sigma |
Potentially Suspicious Child Process Of VsCode |
test |
2023-10-25 |
| sigma |
Potentially Suspicious Office Document Executed From Trusted Location |
test |
2023-10-18 |
| sigma |
Renamed CURL.EXE Execution |
test |
2023-10-12 |
| sigma |
Rundll32 Execution Without CommandLine Parameters |
test |
2023-08-31 |
| sigma |
Custom File Open Handler Executes PowerShell |
test |
2023-08-17 |
| sigma |
Uncommon Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
Suspicious Child Process Of BgInfo.EXE |
test |
2023-08-16 |
| sigma |
WSL Child Process Anomaly |
test |
2023-08-15 |
| sigma |
Indirect Command Execution From Script File Via Bash.EXE |
test |
2023-08-15 |
| sigma |
Indirect Inline Command Execution Via Bash.EXE |
test |
2023-08-15 |
| sigma |
Arbitrary Command Execution Using WSL |
test |
2023-04-12 |
| sigma |
Potential Arbitrary DLL Load Using Winword |
test |
2023-03-29 |
| sigma |
Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE |
test |
2023-02-17 |
| sigma |
Windows Binary Executed From WSL |
test |
2023-02-14 |
| sigma |
Suspicious Remote Child Process From Outlook |
test |
2023-02-09 |
| sigma |
Outlook EnableUnsafeClientMailRules Setting Enabled |
test |
2023-02-09 |
| sigma |
Renamed FTP.EXE Execution |
test |
2023-02-03 |
| sigma |
Suspicious ZipExec Execution |
test |
2022-12-25 |
| sigma |
Suspicious Splwow64 Without Params |
test |
2022-12-25 |
| sigma |
Suspicious Service Binary Directory |
test |
2022-10-09 |
| sigma |
Suspicious Runscripthelper.exe |
test |
2022-07-11 |
| sigma |
Troubleshooting Pack Cmdlet Execution |
test |
2022-06-21 |