| sigma |
AppLocker Application Would Have Been Blocked |
experimental |
2026-10-20 |
| elastic |
Potential Hex Payload Execution via Command-Line |
production |
2026-10-09 |
| elastic |
Base64 Decoded Payload Piped to Interpreter |
production |
2026-10-09 |
| elastic |
Suspicious Execution via Microsoft Office Add-Ins |
production |
2026-10-06 |
| elastic |
Masquerading Space After Filename |
production |
2026-10-05 |
| elastic |
Potential FileFix Command via Windows Explorer Address Bar |
production |
2026-10-05 |
| elastic |
Potential Hex Payload Execution via Common Utility |
production |
2026-10-05 |
| elastic |
Potential Execution via FileFix Phishing Attack |
production |
2026-09-28 |
| elastic |
Lure-Themed Internet-Delivered RMM Executable |
production |
2026-09-24 |
| splunk |
Cisco NVM - Susp Script From Archive Triggering Network Activity |
production |
2026-09-22 |
| elastic |
Potential Widespread Malware Infection Across Multiple Hosts |
production |
2026-09-18 |
| elastic |
Decoded Payload Piped to Interpreter Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Ingress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Encoded Payload Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Malicious File - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Malicious File - Prevented - Elastic Defend |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Multi-Base64 Decoding Attempt from Suspicious Location |
production |
2026-09-18 |
| elastic |
XDG-Open Command Execution |
production |
2026-09-18 |
| elastic |
Executable File Download via Wget |
production |
2026-09-18 |
| elastic |
Gatekeeper Override and Execution |
production |
2026-09-18 |
| elastic |
Suspicious macOS MS Office Child Process |
production |
2026-09-18 |
| elastic |
Potential Notepad Markdown RCE Exploitation |
production |
2026-09-18 |
| elastic |
Execution of File Written or Modified by Microsoft Office |
production |
2026-09-18 |
| elastic |
Java Dropped and Executed With DNS Lookup |
production |
2026-09-18 |
| elastic |
Unusual Execution via Microsoft Common Console File |
production |
2026-09-18 |
| elastic |
Network Connection via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Downloaded URL Files |
production |
2026-09-18 |
| elastic |
Downloaded Shortcut Files |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a Mounted Device |
production |
2026-09-18 |
| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
MS Office Macro Security Registry Modifications |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Business App Installer |
production |
2026-09-18 |
| elastic |
Suspicious Execution from INET Cache |
production |
2026-09-18 |
| elastic |
Microsoft Build Engine Started by an Office Application |
production |
2026-09-18 |
| elastic |
Anomalous Windows Process Creation |
production |
2026-09-18 |
| elastic |
Anomalous Process For a Windows Population |
production |
2026-09-18 |
| elastic |
Unusual Windows Path Activity |
production |
2026-09-18 |
| elastic |
Executable File Creation with Multiple Extensions |
production |
2026-09-18 |
| elastic |
Suspicious HTML File Creation |
production |
2026-09-18 |
| elastic |
Execution of a Downloaded Windows Script |
production |
2026-09-18 |
| elastic |
Network Traffic to Rare Destination Country |
production |
2026-09-18 |
| elastic |
Microsoft Management Console File from Unusual Path |
production |
2026-09-18 |
| elastic |
Process Activity via Compiled HTML File |
production |
2026-09-18 |
| elastic |
Suspicious PDF Reader Child Process |
production |
2026-09-18 |
| elastic |
Windows Script Execution from Archive |
production |
2026-09-18 |
| elastic |
Suspicious Execution from a WebDav Share |
production |
2026-09-18 |
| elastic |
Elastic Defend Alert Followed by Telemetry Loss |
production |
2026-09-18 |
| elastic |
Suspicious MS Outlook Child Process |
production |
2026-09-18 |
| elastic |
Suspicious Execution from VS Code Extension |
production |
2026-09-18 |
| elastic |
Remote Desktop File Opened from Suspicious Path |
production |
2026-09-18 |
| splunk |
Linux Ghostscript Exploitation |
production |
2026-09-01 |
| splunk |
Suspicious Process Executed From Container File |
production |
2026-07-09 |
| splunk |
Batch File Write to System32 |
production |
2026-07-02 |
| splunk |
Windows NorthStar C2 Agent Execution |
production |
2026-05-13 |
| splunk |
O365 SharePoint Malware Detection |
production |
2026-05-13 |
| splunk |
O365 Threat Intelligence Suspicious File Detected |
production |
2026-05-13 |
| splunk |
Drop IcedID License dat |
production |
2026-05-13 |
| splunk |
Single Letter Process On Endpoint |
production |
2026-05-13 |
| splunk |
Windows Advanced Installer MSIX with AI_STUBS Execution |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Full Trust Package Installation |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Package Installation Success |
production |
2026-05-13 |
| splunk |
Windows AppX Deployment Unsigned Package Installation |
production |
2026-05-13 |
| splunk |
Windows Binary Execution from an Archive |
experimental |
2026-05-13 |
| splunk |
Windows Default Cobalt Strike PowerShell Beacon |
production |
2026-05-13 |
| splunk |
Windows Developer-Signed MSIX Package Installation |
production |
2026-05-13 |
| splunk |
Windows EFI Volume Mount Attempt Via Mountvol |
production |
2026-05-13 |
| splunk |
Windows Explorer.exe Spawning PowerShell or Cmd |
production |
2026-05-13 |
| splunk |
Windows Explorer LNK Exploit Process Launch With Padding |
production |
2026-05-13 |
| splunk |
Windows MSIX Package Interaction |
production |
2026-05-13 |
| splunk |
Windows Mustang Panda USB Tool Execution |
production |
2026-05-13 |
| splunk |
Windows PowerShell Script From WindowsApps Directory |
production |
2026-05-13 |
| splunk |
Windows Suspect Process With Authentication Traffic |
production |
2026-05-13 |
| splunk |
Windows Suspicious QEMU Execution |
production |
2026-05-13 |
| splunk |
Windows Universal Data Link File Creation |
production |
2026-05-13 |
| splunk |
Windows User Execution Malicious URL Shortcut File |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
AppLocker Prevented Application or Script from Running |
test |
2025-12-03 |
| sigma |
Windows MSIX Package Support Framework AI_STUBS Execution |
experimental |
2025-11-03 |
| sigma |
Windows AppX Deployment Unsigned Package Installation |
experimental |
2025-11-03 |
| sigma |
Successful MSIX/AppX Package Installation |
experimental |
2025-11-03 |
| sigma |
Windows AppX Deployment Full Trust Package Installation |
experimental |
2025-11-03 |
| sigma |
File With Uncommon Extension Created By An Office Application |
test |
2025-10-17 |
| sigma |
Suspicious Startup Folder Persistence |
test |
2025-10-12 |
| sigma |
Potential Suspicious Browser Launch From Document Reader Process |
test |
2025-10-07 |
| sigma |
Suspicious LNK Command-Line Padding with Whitespace Characters |
experimental |
2025-03-19 |
| sigma |
MMC Executing Files with Reversed Extensions Using RTLO Abuse |
experimental |
2025-02-05 |
| sigma |
Microsoft Word Add-In Loaded |
test |
2024-07-10 |
| sigma |
Kapeka Backdoor Loaded Via Rundll32.EXE |
test |
2024-07-03 |
| sigma |
Microsoft VBA For Outlook Addin Loaded Via Outlook |
test |
2024-03-12 |
| sigma |
HackTool - LittleCorporal Generated Maldoc Injection |
test |
2023-11-28 |
| sigma |
Suspicious WmiPrvSE Child Process |
test |
2023-11-10 |
| sigma |
Remote DLL Load Via Rundll32.EXE |
test |
2023-09-18 |
| sigma |
New Application in AppCompat |
test |
2023-08-17 |
| sigma |
Download From Suspicious TLD - Whitelist |
test |
2023-05-18 |
| sigma |
Download From Suspicious TLD - Blacklist |
test |
2023-05-18 |
| sigma |
Microsoft Excel Add-In Loaded From Uncommon Location |
test |
2023-05-12 |
| sigma |
Microsoft Excel Add-In Loaded |
test |
2023-05-12 |
| sigma |
Suspicious Microsoft Office Child Process |
test |
2023-04-24 |
| sigma |
DotNET Assembly DLL Loaded Via Office Application |
test |
2023-03-29 |
| sigma |
CLR DLL Loaded Via Office Applications |
test |
2023-03-29 |
| sigma |
Suspicious WMIC Execution Via Office Process |
test |
2023-02-14 |
| sigma |
Potential Maze Ransomware Activity |
test |
2023-02-13 |
| sigma |
VBA DLL Loaded Via Office Application |
test |
2023-02-10 |
| sigma |
GAC DLL Loaded Via Office Applications |
test |
2023-02-10 |
| sigma |
Suspicious Outlook Child Process |
test |
2023-02-04 |
| sigma |
Suspicious Binary In User Directory Spawned From Office Application |
test |
2023-02-04 |
| sigma |
Suspicious Microsoft Office Child Process - MacOS |
test |
2023-02-04 |
| sigma |
Flash Player Update from Suspicious Location |
test |
2022-08-08 |
| sigma |
Exploit for CVE-2017-0261 |
test |
2021-11-27 |
| sigma |
Droppers Exploiting CVE-2017-11882 |
stable |
2021-11-27 |
| sigma |
Exploit for CVE-2017-8759 |
test |
2021-11-27 |
| sigma |
Ursnif Malware C2 URL Pattern |
stable |
2021-08-09 |