Attributed metadata history
Up to 100 retained publisher events per page for 4e5a43b9f75cf7845d76c385df7529890d9d66060f10d2afb74a82009d8376cc. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🌐 Suspicious Network and Shell Activity 🌐 Introduced new analytics for browser-spawned Unix shells with external connections, uncommon and rare network connections from LOLBAS binaries, and suspicious Socat listener and remote TCP activity. This coverage helps defenders identify potential command execution, network tunneling, proxying, and command-and-control behavior originating from browsers or trusted system utilities. 🍎 macOS AppleScript and User Interaction 🍎 Added two macOS analytics covering AppleScript shell execution and compilation, as well as suspicious user prompts displayed through osascript. These detections improve visibility into script-based execution and potentially deceptive user interaction used to facilitate malicious activity on macOS endpoints. 🪟 Windows Account and Browser Activity 🪟 Expanded Windows coverage with detections for changes to built-in account names and execution of content copied from a browser. These analytics help identify account manipulation and suspicious execution workflows that may involve commands or payloads copied from web content. 🧩 SCCM Abuse Detection 🧩 Introduced two analytics focused on
Fingerprint: 9d11fe733d7a6de885e3f6bb4ffa176b9c4c73760bd33adb0d5b97aa2b59e696
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c