Attributed metadata history

Release r2026-07-01

New Rules new: Antivirus - APT Malware Signature new: Antivirus - Remote Access Tools Signature new: AppLocker Application Would Have Been Blocked new: Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator new: Curl File Upload To File Sharing Websites new: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog new: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 new: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator new: NTLM Hash Leak Via Curl NTLM Authentication new: New Agent Skills Installation Attempt Via Node.EXE new: Process Execution from Shared Memory Directory new: RedTail Cryptominer User-Agent new: Registry Enumeration via WMI Stdregprov new: Signed DLL Loaded With Missing PE Version Metadata new: TanStack Supply-Chain Attack DNS Indicators new: TanStack Supply-Chain Attack Execution Indicators - Linux new: TanStack Supply-Chain Attack Execution Indicators - Windows new: TanStack Supply-Chain Attack File Creation Indicators - Linux new: TanStack Supply-Chain Attack File Creation Indicators - Windows new: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE Updated Rules update: 7Zip Compressing Dump Files - Add missing 7zr.exe OriginalFileName entries update: Amsi.DLL Load By Uncommon Process - add ARM64 (*64a.exe) variant update: Antivirus - Exploitation Framework Signature - add multiple new strings update: Antivirus - Hacktool Signature - add multiple new strings update: Antivirus - Password Dumper Signature - add multiple new strings update: Antivirus - Ransomware Signature - add multiple new strings update: Antivirus - Relevant File Paths Alerts Signature - change to new style title update: Antivirus - Web Shell Detection Signature - change to new style title update: Application Termination Attempt Via Wmic.EXE - rename, expand description update: BITS Transfer Job Download From File Sharing Domains - add more file sharing domains update: Compress Data and Lock With Password for Exfiltration With 7-ZIP - Add missing 7zr.exe OriginalFileName entries update: CredUI.DLL Loaded By Uncommon Process - add ARM64 (*64a.exe) variant update: HackTool - SysmonEnte Execution - add ARM64 (*64a.exe) variant update: Legitimate Application Dropped Executable - add .pyc, .jar extensions update: Legitimate Application Dropped Script - add various scripts extensions update: Local System Accounts Discovery - MacOs - Re-work logic to enhance coverage and fix incorrect assumptions update: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - add more file sharing domains update: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - add more file sharing domains update: New Connection Initiated To Potential Dead Drop Resolver Domain - add more file sharing domains update: NewActiveScriptEventConsumer Creation Attempt Via Wmic.EXE - rename, expand description, add OriginalFileName to detection update: Password Protected Compressed File Extraction Via 7Zip - Add missing 7zr.exe OriginalFileName entries update: Permission Check Via Accesschk.EXE - add ARM64 (*64a.exe) variant update: Potential Credential Dumping Activity Via LSASS - add ARM64 (*64a.exe) variant update: Potential Defense Evasion Via Binary Rename - Add missing 7zr.exe OriginalFileName entries update: Potential Defense Evasion Via Rename Of Highly Relevant Binaries - add ARM64 (*64a.exe) variant update: Potential Privileged System Service Operation - SeLoadDriverPrivilege - add ARM64 (*64a.exe) variant update: Potential Process Reconnaissance Via Wmic.EXE - rename, expand description, add discovery tags, add terminate filter update: Potential WinAPI Calls Via PowerShell Scripts - add local shellcode injection patterns update: Potentially Suspicious AccessMask Requested From LSASS - add ARM64 (*64a.exe) variant update: Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE - add more file sharing do

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.