| elastic |
Threat Intel URL Indicator Match |
production |
2026-09-18 |
| elastic |
Rapid7 Threat Command CVEs Correlation |
production |
2026-09-18 |
| elastic |
Suspicious Inter-Process Communication via Outlook |
production |
2026-09-18 |
| elastic |
Exporting Exchange Mailbox via PowerShell |
production |
2026-09-18 |
| elastic |
Exchange Mailbox Export via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Audio Capture Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Clipboard Retrieval Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Keylogging Script |
production |
2026-09-18 |
| elastic |
PowerShell Mailbox Collection Script |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Screenshot Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Script with Webcam Video Capture Capabilities |
production |
2026-09-18 |
| elastic |
Encrypting Files with WinRar or 7z |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Certreq |
production |
2026-09-18 |
| elastic |
Connection to Commonly Abused Web Services |
production |
2026-09-18 |
| elastic |
First Time Seen DNS Query to RMM Domain |
production |
2026-09-18 |
| elastic |
Network Activity to a Suspicious Top Level Domain |
production |
2026-09-18 |
| elastic |
Potential DNS Tunneling via NsLookup |
production |
2026-09-18 |
| elastic |
Connection to Commonly Abused Free SSL Certificate Providers |
production |
2026-09-18 |
| elastic |
Potential File Download via a Headless Browser |
production |
2026-09-18 |
| elastic |
Potential Command and Control via Internet Explorer |
production |
2026-09-18 |
| elastic |
Ingress Transfer via Windows BITS |
production |
2026-09-18 |
| elastic |
Multiple Remote Management Tool Vendors on Same Host |
production |
2026-09-18 |
| elastic |
First Time Seen Remote Monitoring and Management Tool |
production |
2026-09-18 |
| elastic |
First Time Seen RMM Signer Across the Environment |
production |
2026-09-18 |
| elastic |
Newly Observed ScreenConnect Host Server |
production |
2026-09-18 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
Outlook Home Page Registry Modification |
production |
2026-09-18 |
| elastic |
Port Forwarding Rule Addition |
production |
2026-09-18 |
| elastic |
Quick Assist Full Control Sharing Mode Enabled |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| elastic |
Potential REMCOS Trojan Execution |
production |
2026-09-18 |
| elastic |
Remote File Download via Desktopimgdownldr Utility |
production |
2026-09-18 |
| elastic |
Remote File Download via MpCmdRun |
production |
2026-09-18 |
| elastic |
Remote File Download via PowerShell |
production |
2026-09-18 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-09-18 |
| elastic |
Remote Management Access Launch After MSI Install |
production |
2026-09-18 |
| elastic |
NetSupport Manager Execution from an Unusual Path |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |