Attributed metadata history

Release r2025-07-08

New Rules new: Attempts of Kerberos Coercion Via DNS SPN Spoofing new: BITS Client BitsProxy DLL Loaded By Uncommon Process new: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall new: DNS Query To Common Malware Hosting and Shortener Services new: DNS Query To Katz Stealer Domains new: DNS Query To Katz Stealer Domains - Network new: Disable ASLR Via Personality Syscall - Linux new: FileFix - Command Evidence in TypedPaths from Browser File Upload Abuse new: FileFix - Suspicious Child Process from Browser File Upload Abuse new: HKTL - SharpSuccessor Privilege Escalation Tool Execution new: HackTool - Doppelanger LSASS Dumper Execution new: HackTool - HollowReaper Execution new: HackTool - Impacket File Indicators new: Katz Stealer DLL Loaded new: Katz Stealer Suspicious User-Agent new: MSSQL Destructive Query new: Obfuscated PowerShell MSI Install via WindowsInstaller COM new: Potential AS-REP Roasting via Kerberos TGT Requests new: Potential Abuse of Linux Magic System Request Key new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access new: Potential Java WebShell Upload in SAP NetViewer Server new: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation new: Potential Notepad++ CVE-2025-49144 Exploitation new: Potential SAP NetViewer Webshell Command Execution new: PowerShell MSI Install via WindowsInstaller COM From Remote Location new: Proxy Execution via Vshadow - detect invocation of vshadow.exe with -exec to spot hidden malware execution new: RegAsm.EXE Execution Without CommandLine Flags or Files new: Registry Export of Third-Party Credentials new: Remote Access Tool - Potential MeshAgent Usage - MacOS new: Remote Access Tool - Potential MeshAgent Usage - Windows new: Remote Access Tool - Suspicious MeshAgent Usage - MacOS new: Remote Access Tool - Suspicious MeshAgent Usage - Windows new: Special File Creation via Mknod Syscall new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network new: Suspicious Deno File Written from Remote Source new: Suspicious Download and Execute Pattern via Curl/Wget new: Suspicious File Access to Browser Credential Storage new: System Info Discovery via Sysinfo Syscall new: System Information Discovery via Registry Queries new: Trusted Path Bypass via Windows Directory Spoofing Updated Rules update: Access of Sudoers File Content - add more tools update: AspNetCompiler Execution - Add ARM version of the \Microsoft.NET path update: Audio Capture - use syscall name instead of id update: Cisco Modify Configuration - add "ntp server" keyword update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - use syscall name instead of id update: Commands to Clear or Remove the Syslog - detect journald vacuuming update: Disable ASLR Via Personality Syscall - Linux - use syscall name instead of id update: Disable Internal Tools or Feature in Registry - More registry modifications associated with feature change of windows internal tools added update: Enumeration for 3rd Party Creds From CLI - Updated the condition to update FP update: File Decoded From Base64/Hex Via Certutil.EXE - Increase level to high update: FileFix - Suspicious Child Process from Browser File Upload Abuse - add cmd.exe child process update: HackTool - LaZagne Execution: filter added to reduce FP and added more coverage through imphash update: Local Groups Discovery - Linux - add text output tools update: MSHTA Execution with Suspicious File Extensions - title changed and more susp extension added update: Malicious PowerShell Commandlets - PoshModule - Add BadSuccessor Exploit update: Malicious PowerShell Commandlets - PoshModule - add Invoke-PowerDPAPI update: Malicious PowerShell Commandlets - ProcessCreation - add Invo

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.