| elastic |
Potential OpenSSH Backdoor Logging Activity |
production |
2026-10-08 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-10-08 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-10-06 |
| splunk |
Circle CI Disable Security Step |
deprecated |
2026-10-01 |
| splunk |
Circle CI Disable Security Job |
deprecated |
2026-10-01 |
| elastic |
Potential SSH Password Grabbing via strace |
production |
2026-09-18 |
| elastic |
Unusual Exim4 Child Process |
production |
2026-09-18 |
| elastic |
Sublime Plugin or Application Script Modification |
production |
2026-09-18 |
| elastic |
Suspicious Communication App Child Process |
production |
2026-09-18 |
| elastic |
Potential Masquerading as Communication Apps |
production |
2026-09-18 |
| elastic |
Potential Masquerading as System32 DLL |
production |
2026-09-18 |
| elastic |
Deprecated - Adobe Hijack Persistence |
deprecated |
2026-08-19 |
| splunk |
Shai-Hulud Workflow File Creation or Modification |
production |
2026-05-13 |
| splunk |
GitHub Workflow File Creation or Modification |
production |
2026-05-13 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
Linux Setuid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| sigma |
Linux Setgid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| sigma |
HybridConnectionManager Service Running |
test |
2024-08-05 |
| sigma |
DNS HybridConnectionManager Service Bus |
test |
2023-01-16 |
| sigma |
HybridConnectionManager Service Installation |
test |
2022-10-09 |
| sentinel |
Potential Build Process Compromise |
Scheduled |
— |