Attributed metadata history

Release r2026-01-01

New Rules new: AMSI Disabled via Registry Modification new: Cmd Launched with Hidden Start Flags to Suspicious Targets new: Devcon Execution Disabling VMware VMCI Device new: Github Self-Hosted Runner Execution new: HTML File Opened From Download Folder new: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine new: Legitimate Application Writing Files In Uncommon Location new: Linux Setgid Capability Set on a Binary via Setcap Utility new: Linux Setuid Capability Set on a Binary via Setcap Utility new: Linux Suspicious Child Process From Node.js - React2Shell new: OpenCanary - Host Port Scan (SYN Scan) new: OpenCanary - NMAP FIN Scan new: OpenCanary - NMAP NULL Scan new: OpenCanary - NMAP OS Scan new: OpenCanary - NMAP XMAS Scan new: OpenCanary - RDP New Connection Attempt new: PUA - Kernel Driver Utility (KDU) Execution new: Registry Modification for OCI DLL Redirection new: Successful MSIX/AppX Package Installation new: Suspicious ArcSOC.exe Child Process new: Suspicious File Created by ArcSOC.exe new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs new: Suspicious Shell Open Command Registry Modification new: User Shell Folders Registry Modification via CommandLine new: Vulnerable Driver Blocklist Registry Tampering Via CommandLine new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze new: Windows AMSI Related Registry Tampering Via CommandLine new: Windows AppX Deployment Full Trust Package Installation new: Windows AppX Deployment Unsigned Package Installation new: Windows Credential Guard Disabled - Registry new: Windows Credential Guard Registry Tampering Via CommandLine new: Windows Credential Guard Related Registry Value Deleted - Registry new: Windows MSIX Package Support Framework AI_STUBS Execution new: Windows Suspicious Child Process From Node.js - React2Shell new: Windows Vulnerable Driver Blocklist Disabled Updated Rules update: ASLR Disabled Via Sysctl or Direct Syscall - Linux - Updated syscall field to SYSCALL in order to make use of enriched logs update: AppX Located in Uncommon Directory Added to Deployment Pipeline - Enhance selection criteria update: Audio Capture - Updated syscall field to SYSCALL in order to make use of enriched logs update: BITS Transfer Job Download From File Sharing Domains - add github.com update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - Updated syscall field to SYSCALL in order to make use of enriched logs update: Creation Of Non-Existent System DLL - Add new DLLs and update metadata update: Curl Web Request With Potential Custom User-Agent - add another curl supported flag for header update: DNS Query to External Service Interaction Domains - Changed modifier to endswith for better accuracy and add additional domains. update: Direct Autorun Keys Modification - remove User Shell Folder registry modification update: File Download Via Bitsadmin To A Suspicious Target Folder - add more susp locations update: Hacktool - EDR-Freeze Execution - add more coverage update: Malicious PowerShell Commandlets - PoshModule - add Invoke-DNSExfiltrator update: Malicious PowerShell Commandlets - ProcessCreation - add Invoke-DNSExfiltrator update: Malicious PowerShell Commandlets - ScriptBlock - add Invoke-DNSExfiltrator update: Malicious PowerShell Scripts - FileCreation - add Invoke-DNSExfiltrator update: Malicious PowerShell Scripts - PoshModule - add Invoke-DNSExfiltrator update: Modify User Shell Folders Startup Value - add new registry path, also add filtering of legit paths update: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - add github.com update: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - add github.com update: Potential DLL Sideloading Of Non-Existent DLLs From Sy

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.