intelligence_src_732996d4d78decf6b7
- Source-provided label
- Publisher RSS metadata
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Aug 17, 2026 18:07 UTC
- Retrieved
- Oct 17, 2026 02:14 UTC
v4.29.0
What's Changed 🆕 New features and detections 🎉 fix(932): add backslash-prefix evasion to shell command detection by @zoutjebot in #4599 feat(unix): detect basic quote evasion attempts against known unix commands by @EsadCetiner in #4649 feat(unix): detect stat command at pl-2+ by @EsadCetiner in #4735 feat: Expand web shells (v1) by @HackingRepo in #4626 🧰 Other Changes fix: allow optional json. prefix in rule 932171 ARGS_NAMES pattern by @fzipi in #4703 fix(942190): require operator or quote after '!' to cut natural-language FPs by @fzipi in #4704 fix(942200): tighten comma branch to cut UA/Referer false positives by @fzipi in #4665 fix(942390): remove bypassable length bound on quoted/unary literals by @fzipi in #4713 fix(953100): more FPs related to RESPONSE_BODY ("(inclusive)" and "must be a valid") by @azurit in #4697 fix(932): remove w from Unix no-arguments command list by @zoutjebot in #4592 fix(932): require arguments for base64, lastlog, lastlogin by @zoutjebot in #4593 fix(953100): FP with '> in all' in RESPONSE_BODY by @azurit in #4736 feat(930120): restore node_modules coverage by @Prateeksaini12 in #4681 fix(942190): Fix the message to reflect that the rule applies to all SQL DBs by @aryehb in #4671 Full Changelog: v4.28.0...v4.29.0
Reference details
- Source category
- research-report
- First reported
- Aug 17, 2026 18:07 UTC
- Last reported
- Aug 17, 2026 18:07 UTC
- Catalog updated
- Oct 17, 2026 02:14 UTC
- Record ID
f0e60694a6921c779a56d8300728fec99bef41e5de3da6d5c06de941231a56c7
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Review source update dates and status
- intelligence_src_732996d4d78decf6b7Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.