Attributed metadata history
Up to 100 retained publisher events per page for 03065f8ab763ac5d97afcdb7ff6cbf1e5ec747d2cb8900b628adba1a91b0d158. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🍎 Expanded macOS AppleScript and osascript coverage 🍎 Added three new macOS analytics that identify osascript executing interactive shells, JavaScript for Automation code using the Objective-C bridge, and long-lived network connections. This improves visibility into script-based execution, remote access, command-and-control activity, and post-exploitation behavior on macOS endpoints. 🪟 Windows ClickFix and LOLBin detection coverage 🪟 Added four new Windows analytics covering remote connections through finger.exe, command execution through for /f loops, JavaScript execution by node.exe from unusual directories, and processes accessing the IronLanguages repository on GitHub. Together, these detections improve visibility into ClickFix-related execution chains, payload retrieval, scripting abuse, and the use of trusted utilities for malicious activity. 🔐 Improved credential-access and process-injection detection 🔐 Updated multiple detections leveraging the process access data source, covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export activity, handle duplication, and process injection. These
Fingerprint: fbe15951fdc114e645f6489766a05c2e0a0777b1e51ee3b49fe102ae96293aa1
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c