Attributed metadata history
Up to 100 retained publisher events per page for 6469723bea229825cf372390bd0bc722786b0de2491ab24a69c16038fdca8b29. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_2009f6680f46118c1b
observed · 2026-10-12 07:28:02 UTC
available
Fingerprint: 0770f7f331815970c09d7c7df4c1b4100c1c363dd891c2cad4eeab14d5b30017
intelligence_src_2009f6680f46118c1b
observed · 2026-10-12 07:28:02 UTC
New Rules new: Azure Login Bypassing Conditional Access Policies new: CVE-2024-49113 Exploitation Attempt - LDAP Nightmare new: Suspicious Binaries and Scripts in Public Folder new: Suspicious Invocation of Shell via Rsync new: Windows Event Log Access Tampering Via Registry Updated Rules update: Exploit Framework User Agent - Add default Havoc C2 UA update: Renamed Powershell Under Powershell Channel - Update regex to use \s+ to account for different parsers update: Shell Execution via Rsync - Linux - Rework logic to make it more generic and include additional shells. update: Suspicious Non PowerShell WSMAN COM Provider - Update regex to use \s+ to account for different parsers update: Suspicious Windows Service Tampering - Add additional services Removed / Deprecated Rules remove: Windows Defender Exclusion Deleted Fixed Rules fix: BITS Transfer Job With Uncommon Or Suspicious Remote TLD - Add dn.onenote.net/ and cdn.office.net/ fix: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation - Add filter for Kaspersky and mDNS Responder fix: Failed Code Integrity Checks - Add filters for CrowdStrike. fix: Forest Blizzard APT - Process Creation Activity - pre
Fingerprint: d59c1a0d00573d554c4d2125fe671e7be2e3aa1e4739cd36000355974104cfa3