| elastic |
MsBuild Making Network Connections |
production |
2026-09-18 |
| elastic |
Mshta Making Network Connections |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft HTML Application Child Process |
production |
2026-09-18 |
| elastic |
MsiExec Service Child Process With Network Connection |
production |
2026-09-18 |
| elastic |
Potential Remote Install via MsiExec |
production |
2026-09-18 |
| elastic |
Network Connection via MsXsl |
production |
2026-09-18 |
| elastic |
Unusual Network Activity from a Windows System Binary |
production |
2026-09-18 |
| elastic |
Potential NetNTLMv1 Downgrade Attack |
production |
2026-09-18 |
| elastic |
Command Obfuscation via Unicode Modifier Letters |
production |
2026-09-18 |
| elastic |
Parent Process PID Spoofing |
production |
2026-09-18 |
| elastic |
Local Account TokenFilter Policy Disabled |
production |
2026-09-18 |
| elastic |
Suspicious .NET Reflection via PowerShell |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Payload Encoded and Compressed |
production |
2026-09-18 |
| elastic |
PowerShell Script with Windows Defender Tampering Capabilities |
production |
2026-09-18 |
| elastic |
PowerShell Script with Encryption/Decryption Capabilities |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscated Script via High Entropy |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Invalid Escape Sequences |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Character Array Reconstruction |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via High Numeric Character Proportion |
production |
2026-09-18 |
| elastic |
Potential Dynamic IEX Reconstruction via Environment Variables |
production |
2026-09-18 |
| elastic |
Dynamic IEX Reconstruction via Method String Access |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Reverse Keywords |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Concatenation |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via String Reordering |
production |
2026-09-18 |
| elastic |
Potential PowerShell Obfuscation via Special Character Overuse |
production |
2026-09-18 |
| elastic |
Potential Process Injection via PowerShell |
production |
2026-09-18 |
| elastic |
Windows Firewall Disabled via PowerShell |
production |
2026-09-18 |
| elastic |
Suspicious Microsoft Diagnostics Wizard Execution |
production |
2026-09-18 |
| elastic |
DNS Global Query Block List Modified or Disabled |
production |
2026-09-18 |
| elastic |
Potential RemoteMonologue Attack |
production |
2026-09-18 |
| elastic |
File with Right-to-Left Override Character (RTLO) Created/Executed |
production |
2026-09-18 |
| elastic |
Alternate Data Stream Creation/Execution at Volume Root Directory |
production |
2026-09-18 |
| elastic |
Windows Sandbox with Sensitive Configuration |
production |
2026-09-18 |
| elastic |
Unusual Child Processes of RunDLL32 |
production |
2026-09-18 |
| elastic |
Service DACL Modification via sc.exe |
production |
2026-09-18 |
| elastic |
Potential Windows Session Hijacking via CcmExec |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
Script Execution via Microsoft HTML Application |
production |
2026-09-18 |