| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Suspicious Execution via Microsoft Office Add-Ins |
production |
2026-10-06 |
| elastic |
Masquerading Space After Filename |
production |
2026-10-05 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| elastic |
Potential ClickFix Command via Windows Run Dialog |
production |
2026-10-05 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
Potential TerminalFix Cloudflare Lure in PowerShell |
production |
2026-09-28 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Node.js Pre or Post-Install Script Execution |
production |
2026-09-25 |
| elastic |
Google Workspace Object Copied from External Drive with App Consent |
production |
2026-09-24 |
| elastic |
Lure-Themed Internet-Delivered RMM Executable |
production |
2026-09-24 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Malicious File - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Malicious File - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
XDG-Open Command Execution |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Apple Mail Rule Plist Modification |
production |
2026-09-18 |
| elastic |
Spike in host-based traffic |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Unusual Windows Path Activity |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Windows Population |
production |
2026-09-18 |
| elastic |
Anomalous Windows Process Creation |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
MS Office Macro Security Registry Modifications |
production |
2026-09-18 |
| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
Downloaded Shortcut Files |
production |
2026-09-18 |
| elastic |
Downloaded URL Files |
production |
2026-09-18 |
| elastic |
Network Connection via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Unusual Execution via Microsoft Common Console File |
production |
2026-09-18 |
| elastic |
Java Dropped and Executed With DNS Lookup |
production |
2026-09-18 |
| elastic |
Execution of File Written or Modified by Microsoft Office |
production |
2026-09-18 |
| elastic |
Potential Notepad Markdown RCE Exploitation |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Windows Script Execution from Archive |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Process Activity via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Microsoft Management Console File from Unusual Path |
production |
2026-09-18 |
| elastic |
Potential Fake CAPTCHA Phishing Attack |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| elastic |
Suspicious HTML File Creation |
production |
2026-09-18 |
| elastic |
Suspicious Execution from INET Cache |
production |
2026-09-18 |
| elastic |
Remote Desktop File Opened from Suspicious Path |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Potential Widespread Malware Infection Across Multiple Hosts |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| sigma |
Antivirus - Hacktool Signature |
stable |
2026-06-15 |
| splunk |
Kubernetes Anomalous Outbound Network Activity from Process |
experimental |
2026-05-13 |
| splunk |
Kubernetes Anomalous Traffic on Network Edge |
experimental |
2026-05-13 |
| splunk |
Kubernetes Create or Update Privileged Pod |
production |
2026-05-13 |
| splunk |
Kubernetes DaemonSet Deployed |
production |
2026-05-13 |
| splunk |
Kubernetes Falco Shell Spawned |
production |
2026-05-13 |
| splunk |
Kubernetes newly seen TCP edge |
experimental |
2026-05-13 |
| splunk |
Kubernetes newly seen UDP edge |
experimental |
2026-05-13 |
| splunk |
Kubernetes Node Port Creation |
production |
2026-05-13 |
| splunk |
Kubernetes Pod Created in Default Namespace |
production |
2026-05-13 |
| splunk |
Kubernetes Pod With Host Network Attachment |
production |
2026-05-13 |
| splunk |
Kubernetes Previously Unseen Container Image Name |
experimental |
2026-05-13 |
| splunk |
Kubernetes Previously Unseen Process |
experimental |
2026-05-13 |
| splunk |
Kubernetes Process Running From New Path |
experimental |
2026-05-13 |
| splunk |
Kubernetes Process with Anomalous Resource Utilisation |
experimental |
2026-05-13 |
| splunk |
Kubernetes Process with Resource Ratio Anomalies |
experimental |
2026-05-13 |
| splunk |
Kubernetes Shell Running on Worker Node |
experimental |
2026-05-13 |
| splunk |
Kubernetes Shell Running on Worker Node with CPU Activity |
experimental |
2026-05-13 |
| splunk |
Kubernetes Unauthorized Access |
production |
2026-05-13 |
| splunk |
Clop Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Conti Common Exec parameter |
production |
2026-05-13 |
| splunk |
Detect Rare Executables |
production |
2026-05-13 |
| splunk |
Revil Common Exec Parameter |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - Lumma Stealer Activity |
production |
2026-05-13 |
| splunk |
Kubernetes Anomalous Inbound to Outbound Network IO Ratio |
experimental |
2026-05-13 |
| splunk |
Kubernetes Anomalous Inbound Outbound Network IO |
experimental |
2026-05-13 |
| splunk |
Kubernetes Anomalous Inbound Network Activity from Process |
experimental |
2026-05-13 |
| splunk |
AWS Lambda UpdateFunctionCode |
production |
2026-05-13 |
| sigma |
Potential Snatch Ransomware Activity |
stable |
2025-10-19 |
| sigma |
Suspicious Deno File Written from Remote Source |
experimental |
2025-05-22 |
| sigma |
Suspicious Binaries and Scripts in Public Folder |
experimental |
2025-01-23 |
| sigma |
Potentially Suspicious WebDAV LNK Execution |
test |
2023-08-21 |
| sigma |
PrinterNightmare Mimikatz Driver Name |
test |
2023-06-12 |
| sigma |
Suspicious Execution via macOS Script Editor |
test |
2022-12-28 |
| sigma |
Payload Decoded and Decrypted via Built-in Utilities |
test |
2022-10-17 |
| sigma |
Arbitrary Shell Command Execution Via Settingcontent-Ms |
test |
2022-04-14 |
| sigma |
DarkSide Ransomware Pattern |
test |
2021-05-14 |
| sentinel |
Audit policy manipulation using auditpol utility |
Scheduled |
— |