| elastic |
Remote File Download via Desktopimgdownldr Utility |
production |
2026-09-18 |
| elastic |
Remote File Download via MpCmdRun |
production |
2026-09-18 |
| elastic |
Remote File Download via PowerShell |
production |
2026-09-18 |
| elastic |
Remote File Download via Script Interpreter |
production |
2026-09-18 |
| elastic |
Remote Management Access Launch After MSI Install |
production |
2026-09-18 |
| elastic |
NetSupport Manager Execution from an Unusual Path |
production |
2026-09-18 |
| elastic |
RMM Software Installation from a Commonly Abused Web Service |
production |
2026-09-18 |
| elastic |
RMM Software Installation from an Internet-Originated MSI |
production |
2026-09-18 |
| elastic |
Suspicious ScreenConnect Client Child Process |
production |
2026-09-18 |
| elastic |
Remote File Copy via TeamViewer |
production |
2026-09-18 |
| elastic |
Potential File Transfer via Curl for Windows |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: sqlmap User Agent |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: Unauthorized Method |
production |
2026-09-18 |
| elastic |
Web Application Suspicious Activity: POST Request Declined |
production |
2026-09-18 |
| elastic |
Potential Traffic Tunneling using QEMU |
production |
2026-09-18 |
| elastic |
Kubectl Network Configuration Modification |
production |
2026-09-18 |
| elastic |
PANW and Elastic Defend - Command and Control Correlation |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
FortiGate SOCKS Traffic from an Unusual Process |
production |
2026-09-18 |
| elastic |
Suricata and Elastic Defend Network Correlation |
production |
2026-09-18 |
| elastic |
Suspicious File Downloaded from Google Drive |
production |
2026-09-18 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| snort |
ET TROJAN AsyncRAT Powershell Payload |
rev 1 |
2026-09-18 |
| snort |
ET TROJAN MakinoLoader CnC Checkin |
rev 1 |
2026-09-18 |
| snort |
ET TROJAN MakinoLoader Victim HeartBeat |
rev 1 |
2026-09-18 |
| suricata |
ET MALWARE MakinoLoader CnC Checkin |
rev 1 |
2026-09-18 |
| suricata |
ET MALWARE AsyncRAT Powershell Payload |
rev 1 |
2026-09-18 |
| suricata |
ET MALWARE MakinoLoader Victim HeartBeat |
rev 1 |
2026-09-18 |
| elastic |
Potential Uninstall Entry Concealment |
production |
2026-09-17 |
| elastic |
Excessive Sudo Authentication Failures via macOS Security Events |
production |
2026-09-17 |
| elastic |
Privilege Escalation via Parallels Appliance Extract Argument Injection |
production |
2026-09-17 |
| sigma |
Potential PowerShell Obfuscation Using Alias Cmdlets |
test |
2026-09-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.chanka .com domain |
rev 1 |
2026-09-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.chanka .com domain |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Exploit Kit Profiler Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed BlueMoon EK CnC Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| snort |
ET INFO Zecurit RMM Activity - Agent Inbound Command Recieved |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed BlueMoon EK CnC Related Domain in TLS SNI |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Exploit Kit Profiler Related Domain in DNS Query |
rev 1 |
2026-09-17 |
| snort |
ET TROJAN Observed Cobalt Strike CnC Related Domain in DNS Query |
rev 1 |
2026-09-17 |