| sigma |
Potential In-Memory Execution Using Reflection.Assembly |
test |
2026-10-19 |
| elastic |
Memory Threat - Detected - Elastic Defend |
production |
2026-09-18 |
| elastic |
Process Started with Executable Stack |
production |
2026-09-18 |
| elastic |
Network Connection from Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Unknown Execution of Binary with RWX Memory Region |
production |
2026-09-18 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Managed Code Hosting Process |
production |
2026-09-18 |
| elastic |
Suspicious Java Class File Created in PaperCut Server Library |
production |
2026-09-18 |
| elastic |
Suspicious Process Execution Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Memory Threat - Prevented- Elastic Defend |
production |
2026-09-18 |
| elastic |
Potential Fileless Execution via Unusual memfd Create Call |
production |
2026-09-08 |
| splunk |
PowerShell PInvoke Process Injection API Chain |
production |
2026-06-25 |
| splunk |
Windows MMC Loaded Script Engine DLL |
production |
2026-05-13 |
| sigma |
Potential WinAPI Calls Via PowerShell Scripts |
test |
2026-04-29 |
| sigma |
PowerShell Base64 Encoded Reflective Assembly Load |
test |
2023-01-30 |