Attributed metadata history

Release r2026-04-01

New Rules new: Axios NPM Compromise File Creation Indicators - Linux new: Axios NPM Compromise File Creation Indicators - MacOS new: Axios NPM Compromise File Creation Indicators - Windows new: Axios NPM Compromise Indicators - Linux new: Axios NPM Compromise Indicators - MacOS new: Axios NPM Compromise Indicators - Windows new: Axios NPM Compromise Malicious C2 Domain DNS Query new: Azure Sign-In With Axios User Agent new: Cisco Dot1x Disabled new: DMSA Link Attributes Modified new: DMSA Service Account Created in Specific OUs - PowerShell new: Google Workspace Government Attack Warning new: Google Workspace Out Of Domain Email Forwarding new: HackTool - NetExec File Indicators new: Hacktool - NetExec Execution new: Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet new: Inbox Rules Creation Or Update Activity in O365 new: Indirect Command Execution via SFTP ProxyCommand new: Kubernetes Potential Enumeration Activity new: LiteLLM / TeamPCP Supply Chain Attack Indicators new: Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet new: New DMSA Service Account Created in Specific OUs new: New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created new: Notepad++ Updater DNS Query to Uncommon Domains new: Okta Session Impersonation Granted From Untrusted Domain new: OpenEDR Spawning Command Shell new: PUA - Memory Dump Mount Via MemProcFS new: Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI new: Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 new: Potential Vcruntime140 DLL Sideloading new: Potentially Suspicious File Creation by OpenEDR's ITSMService new: Python Base64 Encoded Inline Command Execution - Linux new: Python Base64 Encoded Inline Command Execution - Windows new: RedSun - Conhost.exe Spawned by TieringEngineService.exe new: RedSun - Named Pipe Created new: RedSun - TieringEngineService.exe Detected as EICAR Test File new: RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir new: Script Interpreter Spawning Credential Scanner - Linux new: Script Interpreter Spawning Credential Scanner - Windows new: Sensitive File Dump Via Print.EXE new: Service Startup Type Change Via Wmic.EXE new: Shai-Hulud 2.0 Malicious NPM Package Installation new: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux new: Shai-Hulud Malicious Bun Execution new: Shai-Hulud Malicious Bun Execution - Linux new: Shai-Hulud Malware Indicators - Linux new: Shai-Hulud Malware Indicators - Windows new: Suspicious Child Process of Notepad++ Updater - GUP.Exe new: Suspicious Child Process of SolarWinds WebHelpDesk new: Suspicious Email Delivered In Microsoft 365 new: Suspicious Login Activity Classified By Google new: System Language Discovery via Reg.Exe new: System Restore Registry Modification via CommandLine new: TeamPCP LiteLLM Supply Chain Attack Persistence Indicators new: Uncommon File Created by Notepad++ Updater Gup.EXE new: Windows EventLog Autologger Session Registry Modification Via CommandLine new: msDS-ManagedAccountPrecededByLink Attribute Modified Updated Rules update: BPFDoor Abnormal Process ID or Lock File Accessed - add new file paths from Rapid7 research to increase coverage update: Csc.EXE Execution Form Potentially Suspicious Parent - Update regex to use a non-capturing group update: Delete Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Disable Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Dynamic .NET Compilation Via Csc.EXE - Update regex to use a non-capturing group update: Files With System Process Name In Unsuspected Locations - Add fsquirt.exe entry update: Github Delete Action Invoked - Rename action from 'codespaces.delete' to 'codespaces.destroy' update: Important Scheduled Task Deleted or Disabled - Add EventID 142. update: Invoke-Obfuscation Obfuscated IEX Invocation - Update regex to use a non-capturing group up

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.