| splunk |
Windows Local LLM Framework Execution |
production |
2026-07-15 |
| splunk |
Windows File Download Via CertUtil |
production |
2026-07-14 |
| splunk |
Windows HTTP Network Communication From MSIExec |
production |
2026-07-14 |
| splunk |
Windows InstallUtil Remote Network Connection |
production |
2026-07-14 |
| splunk |
Windows MSIExec Remote Download |
production |
2026-07-14 |
| splunk |
Windows Curl Upload to Remote Destination |
production |
2026-07-14 |
| splunk |
Windows InstallUtil URL in Command Line |
production |
2026-07-14 |
| splunk |
Windows File Download Via PowerShell |
production |
2026-07-14 |
| splunk |
Detect HTML Help URL in Command Line |
production |
2026-07-14 |
| splunk |
Detect RClone Command-Line Usage |
production |
2026-07-14 |
| splunk |
WMIC XSL Execution via URL |
production |
2026-07-14 |
| splunk |
Windows PowerShell FakeCAPTCHA Clipboard Execution |
production |
2026-07-14 |
| sigma |
Webshell Detection With Command Line Keywords |
test |
2026-07-14 |
| snort |
ET INFO ScreenConnect Initial Origin Checkin |
rev 1 |
2026-07-13 |
| suricata |
ET INFO ScreenConnect Initial Origin Checkin |
rev 1 |
2026-07-13 |
| sigma |
AWS Bedrock Guardrail Deleted |
experimental |
2026-07-10 |
| sigma |
AWS Bedrock Guardrail Updated |
experimental |
2026-07-10 |
| sigma |
Potential System DLL Sideloading From Non System Locations |
test |
2026-07-10 |
| splunk |
Suspicious Process Executed From Container File |
production |
2026-07-09 |
| splunk |
Linux Suspicious XDG Autostart |
production |
2026-07-08 |
| splunk |
Time Provider Persistence Registry |
production |
2026-07-08 |
| splunk |
Linux Usermod Root UID Set |
production |
2026-07-08 |
| splunk |
Linux UDEV Rule Created |
production |
2026-07-08 |
| splunk |
Linux Suspicious Staging of Alternate System Files |
production |
2026-07-08 |
| splunk |
Linux Suspicious Redis Activity |
production |
2026-07-08 |
| splunk |
Linux Suspicious Privileged Container Execution |
production |
2026-07-08 |
| splunk |
Linux Suspicious GCC Invocation Building Init Shared Object |
production |
2026-07-08 |
| splunk |
Linux Suspicious Docker Build Command Execution |
production |
2026-07-08 |
| splunk |
Linux Shell Pseudo Device Reverse Shell |
production |
2026-07-08 |
| splunk |
Linux Shell History Access Via Command Line Utility |
production |
2026-07-08 |
| splunk |
Linux Root Execution of id |
production |
2026-07-08 |
| splunk |
Linux Possible System Binary Backdoor |
production |
2026-07-08 |
| splunk |
Linux Possible Privilege Escalation via PYTHONPATH |
production |
2026-07-08 |
| splunk |
Linux Possible Nimbuspwn Privilege Escalation |
production |
2026-07-08 |
| splunk |
Linux Possible GSM Privilege Escalation |
production |
2026-07-08 |
| splunk |
Linux Possible Bootloader Modification |
production |
2026-07-08 |
| splunk |
Linux Netcat Outbound Connection |
production |
2026-07-08 |
| splunk |
Linux MOTD Script Added |
production |
2026-07-08 |
| splunk |
Linux File Creation In System Generator Directory |
production |
2026-07-08 |
| splunk |
Linux EFI Bootloader File Deletion |
production |
2026-07-08 |