Attributed metadata history
Up to 100 retained publisher events per page for f962cb0122ab4850aa5d971fbd9d49443d15ae058aa7c6b7d6709b77187f0290. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
🚀 Key Highlights 🐧 Linux Detection Coverage Expansion: Added broad new Linux behavioral coverage targeting privilege escalation, persistence, execution, defense evasion, reverse shells, container abuse, and suspicious service activity. New analytics identify behaviors including bootloader and system file modification, shared-memory execution, UDEV and XDG persistence, privileged container execution, PostgreSQL and Redis abuse, Ghostscript exploitation, shell history access, and multiple potential privilege-escalation paths, giving defenders stronger visibility into suspicious activity that can blend with legitimate Linux administration. 🪟 Windows Detection Coverage: Expanded Windows detection coverage with new analytics for network reconnaissance, suspicious PowerShell execution, and abnormal process behavior. New detections identify network sniffing tools, PowerShell commands retrieved through DNS TXT records, directory output piped to Findstr, and suspicious child processes of Consent.exe, helping security teams surface discovery, command execution, defense evasion, and other potentially malicious endpoint activity. 🛠️ Detection Updates & Fixes: Refined six exis
Fingerprint: c95255ea4267945b1f83c4941e733e5adfab432fe2406a4021fb43c789f3c5b1
intelligence_src_457d9a43f60e7e15d0
observed · 2026-10-12 09:23:03 UTC
available
Fingerprint: 46a79d93330609014f09d35b0d753a3dee278bd71aaea4321313d2ee9c64a43c