Attributed metadata history
Up to 100 retained publisher events per page for f0e60694a6921c779a56d8300728fec99bef41e5de3da6d5c06de941231a56c7. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
available
Fingerprint: 9a0f29d779ed105525dbafb009db821a5ae58acc46f95bd8f9161f2e63576dd8
intelligence_src_732996d4d78decf6b7
observed · 2026-10-12 11:25:04 UTC
What's Changed 🆕 New features and detections 🎉 fix(932): add backslash-prefix evasion to shell command detection by @zoutjebot in #4599 feat(unix): detect basic quote evasion attempts against known unix commands by @EsadCetiner in #4649 feat(unix): detect stat command at pl-2+ by @EsadCetiner in #4735 feat: Expand web shells (v1) by @HackingRepo in #4626 🧰 Other Changes fix: allow optional json. prefix in rule 932171 ARGS_NAMES pattern by @fzipi in #4703 fix(942190): require operator or quote after '!' to cut natural-language FPs by @fzipi in #4704 fix(942200): tighten comma branch to cut UA/Referer false positives by @fzipi in #4665 fix(942390): remove bypassable length bound on quoted/unary literals by @fzipi in #4713 fix(953100): more FPs related to RESPONSE_BODY ("(inclusive)" and "must be a valid") by @azurit in #4697 fix(932): remove w from Unix no-arguments command list by @zoutjebot in #4592 fix(932): require arguments for base64, lastlog, lastlogin by @zoutjebot in #4593 fix(953100): FP with '> in all' in RESPONSE_BODY by @azurit in #4736 feat(930120): restore node_modules coverage by @Prateeksaini12 in #4681 fix(942190): Fix the message to reflect that the
Fingerprint: 2fee31610941ed581fbd55c031ee4b63fbb310e0afd9ea245025ed5464b14293