Attributed metadata history
Up to 100 retained publisher events per page for 9ed48f5d8d874eff4ae112288538fd0d2273d9e7e22acece91729023d31fee31. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_2009f6680f46118c1b
observed · 2026-10-12 07:28:02 UTC
available
Fingerprint: 0770f7f331815970c09d7c7df4c1b4100c1c363dd891c2cad4eeab14d5b30017
intelligence_src_2009f6680f46118c1b
observed · 2026-10-12 07:28:02 UTC
New Rules new: AMSI Disabled via Registry Modification new: Cmd Launched with Hidden Start Flags to Suspicious Targets new: Devcon Execution Disabling VMware VMCI Device new: Github Self-Hosted Runner Execution new: HTML File Opened From Download Folder new: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine new: Legitimate Application Writing Files In Uncommon Location new: Linux Setgid Capability Set on a Binary via Setcap Utility new: Linux Setuid Capability Set on a Binary via Setcap Utility new: Linux Suspicious Child Process From Node.js - React2Shell new: OpenCanary - Host Port Scan (SYN Scan) new: OpenCanary - NMAP FIN Scan new: OpenCanary - NMAP NULL Scan new: OpenCanary - NMAP OS Scan new: OpenCanary - NMAP XMAS Scan new: OpenCanary - RDP New Connection Attempt new: PUA - Kernel Driver Utility (KDU) Execution new: Registry Modification for OCI DLL Redirection new: Successful MSIX/AppX Package Installation new: Suspicious ArcSOC.exe Child Process new: Suspicious File Created by ArcSOC.exe new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze new: Su
Fingerprint: 27904f752311ba703fd9599d87552e73be22be34c3db772e84aa3584b4ec6fde