INDICATOR1 SOURCE
URL https://technet.microsoft.com/en-us/sysinternals/bb963902
Indicator published by the cited source.
Collected 2026-10-08 05:47 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations and research history in one connected catalog.
131,398Catalog records
62,804File records
147,419Source observations
123Family labels
131,398 MATCHING RECORDS
INDICATOR1 SOURCE
URL https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection
Indicator published by the cited source.
Collected 2026-10-08 06:20 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1022
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697
Indicator published by the cited source.
Collected 2026-10-08 06:20 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://capec.mitre.org/data/definitions/550.html
Indicator published by the cited source.
Collected 2026-10-08 06:20 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1050
Indicator published by the cited source.
Collected 2026-10-08 05:47 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://technet.microsoft.com/en-us/library/cc772408.aspx
Indicator published by the cited source.
Collected 2026-10-08 06:20 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1035
Indicator published by the cited source.
Collected 2026-10-08 05:47 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://en.wikipedia.org/wiki/List_of_file_signatures
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR2 SOURCES
URL https://attack.mitre.org/techniques/T1048
Indicator published by the cited source.
Collected 2026-10-08 06:03 UTCOpen evidence recordINDICATOR2 SOURCES
URL https://attack.mitre.org/techniques/T1036
Indicator published by the cited source.
Collected 2026-10-08 05:47 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://capec.mitre.org/data/definitions/437.html
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://www.sans.org/reading-room/whitepapers/analyst/finding-hidden-threats-decrypting-ssl-34840
Indicator published by the cited source.
Collected 2026-10-08 08:01 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1032
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://securelist.com/blog/research/57585/winnti-faq-more-than-just-a-game/
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1195
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://dump.gxxservice.com/common/up/up_base.php
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1079
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://capec.mitre.org/data/definitions/438.html
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.fidelissecurity.com/sites/default/files/FTA_1018_looking_at_the_sky_for_a_dark_comet.pdf
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://bugcheck.xigncodeservice.com/Common/Lib/common.php
Indicator published by the cited source.
Collected 2026-10-08 08:03 UTCOpen evidence recordSource labels and confidence are preserved. A filename or report mention alone does not establish that a file is malicious. Indicator observation dates describe the cited source; collection dates describe this catalog.