Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
22 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_457d9a43f60e7e15d0Recent successful batchLast successful batch: Last attempt:
intelligence_src_459d5bae47bc5c4b5eRecent successful batchLast successful batch: Last attempt:
intelligence_src_46713618cff9845ba4Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Microsoft Threat Intelligence examines CVE-2026-73570 exploitation in Zimbra, including observed attack paths, detection opportunities, and mitigation guidance. The post Unauthenticated command injection on internet-facing mail servers: tracking CVE-2026-73570 appeared first on Microsoft Security Blog.
First reported Sep 30, 2026 14:00 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
Prepare for post-quantum authentication by testing certificate ecosystems now. Learn how Microsoft’s PQC TLS Pilot Program helps advance future readiness. The post Post-quantum authentication: Why organizations should start testing certificate ecosystems now appeared first on Microsoft Security Blog.
First reported Oct 08, 2026 20:44 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
This year at Microsoft Ignite, we spotlight our AI-first, end-to-end security platform designed to protect identities, devices, data, applications, clouds, infrastructure, and the AI agents now working alongside your teams. The post Secure what’s next: Your guide to Microsoft Security at Microsoft Ignite 2026 appeared first on Microsoft Security Blog.
First reported Sep 30, 2026 19:31 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
Read highlights from the 2026 Microsoft Digital Defense Report, which reflects a security environment that continues to grow more interconnected. The post Insights from the 2026 Microsoft Digital Defense Report appeared first on Microsoft Security Blog.
First reported Oct 01, 2026 14:00 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
Learn how CISOs can mitigate cybersecurity risks and increase resilience in the age of AI-powered vulnerability management. The post CISO perspectives on managing vulnerability risks in the age of AI appeared first on Microsoft Security Blog.
First reported Oct 06, 2026 16:00 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”. The post Star Blizzard refines phishing and malware delivery with the RedFlick technique appeared first on Microsoft Security Blog.
First reported Sep 29, 2026 15:00 UTCCatalog metadata updated Oct 14, 2026 09:30 UTCOpen evidence record
Running a website means a single unpatched vulnerability can take it offline, harm your reputation, or require cleanup. Most compromises begin with automated attacks exploiting known software flaws, usually reported and disclosed already. To keep you protected from these threats, we’ve compiled this month’s key security updates and vulnerability patches for the WordPress ecosystem. If you’re already using the Sucuri Firewall, you’re protected. These vulnerabilities are virtually patched for all clients. Continue reading Vulnerability & Patch Roundup — July 2026 at Sucuri Blog.
First reported Jul 31, 2026 23:28 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
Third-party scripts are common on websites. They help with analytics, ads, live chat, social media, video, payments, and many other features. While not all are risky, every external tag, pixel, widget, or embed adds to your website’s vulnerability. These tools can read page content, collect visitor data, change what users see, and connect with outside services. If a vendor, account, or setup is compromised, it can impact every page that uses the script. Website owners shouldn’t aim to get rid of useful integrations, but to understand which scripts run, why they are necessary, who controls them, and how to detect unexpected changes. Continue reading Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk at Sucuri Blog.
First reported Aug 24, 2026 22:31 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed. To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem. Continue reading Vulnerability & Patch Roundup — September 2026 at Sucuri Blog.
First reported Oct 01, 2026 04:30 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
Overview During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted. Throughout this article, we’ll refer to this family of malware as SC, named after the “SC_” markers found in the injected content. What makes SC worth documenting is how it survives. The payload lives in at least eight places at once, spread across files, the database, and shared memory, and every one of those places can rebuild all the others. Continue reading SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor at Sucuri Blog.
First reported Oct 01, 2026 00:57 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
Each feature that you add to a website results in a new element that has to be managed. The credentials are accepted by a login page, the data by a contact form, new code is introduced by a plugin, and an API is used to connect your website to another service. It is also possible that an old staging site or a forgotten backup may still be accessible from the internet. The collection of these exposed components constitutes your website attack surface. Continue reading What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk at Sucuri Blog.
First reported Aug 19, 2026 20:06 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed. To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem. Continue reading Vulnerability & Patch Roundup — August 2026 at Sucuri Blog.
First reported Sep 01, 2026 00:00 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
If you run a website, you’ve already met encryption even if you’ve never used the word. It’s the 🔒 padlock in the browser bar, the reason your host told you to stop using plain FTP, and the checkbox on your backup settings that says “encrypt archive.” Encryption is one of the few security controls that works quietly and almost never needs your attention, which is exactly why it’s easy to misunderstand. Plenty of site owners install an SSL certificate, see the padlock appear, and assume the site is now “secure.” That’s the gap we want to close here. Continue reading What Is Encryption? How It Protects Your Website and Its Data at Sucuri Blog.
First reported Oct 12, 2026 18:00 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
Starting August 10, 2026, Sucuri will begin moving customer account logins to a new authentication platform designed to provide a stronger, more modern sign-in experience. The rollout will happen gradually over the following few weeks, so not every account will transition at the same time. For most users, there is nothing to do. Your password will remain the same, your current two-factor authentication setup will continue working, and existing bookmarks to the Sucuri dashboard login page will automatically redirect to the new sign-in page. Continue reading Upgrading How You Sign In to Your Sucuri Account at Sucuri Blog.
First reported Aug 07, 2026 18:46 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
Updating WordPress directly on a live website can cause avoidable problems. A plugin update might break checkout, or a theme change could create layout issues visitors see immediately. A WordPress staging site gives you a separate place to test changes before they reach your live website. Staging reduces operational risk, but it also creates another website that needs protection. A copied site may contain administrator accounts, customer records, API keys, or vulnerable software. Continue reading How to Create a Secure WordPress Staging Site: Beginner’s Guide at Sucuri Blog.
First reported Aug 11, 2026 16:30 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
2026: the year the tools learned to hack In May 2026, OpenAI began testing an internal research model against a cybersecurity benchmark called ExploitGym. While the test environment was not supposed to have access to the open internet, there was, however, one narrow path out because the agents still needed a way to install software: an internally hosted Artifactory server that acted as a cache for package downloads. That pathway turned out to be enough for the model’s agents to eventually circumvent the test’s rules and escape confinement. Continue reading The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research. at Sucuri Blog.
First reported Aug 15, 2026 01:06 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
In short, WordPress security plugins are tools you add to your site to strengthen your settings, scan for malware, watch for file changes, and block suspicious activity from within WordPress. Most sites should use one, along with a firewall that filters traffic before WordPress even loads. Look for layered protection, good detection, clear handling of false alarms, minimal impact on performance, and real human support. If you manage a WordPress site, you have probably searched for “best WordPress security plugin” at some point. Continue reading WordPress Security Plugins: How to Choose the Right One at Sucuri Blog.
First reported Sep 05, 2026 03:01 UTCCatalog metadata updated Oct 14, 2026 09:27 UTCOpen evidence record
🚀 Key Highlights 🍎 Expanded macOS AppleScript and osascript coverage 🍎 Added three new macOS analytics that identify osascript executing interactive shells, JavaScript for Automation code using the Objective-C bridge, and long-lived network connections. This improves visibility into script-based execution, remote access, command-and-control activity, and post-exploitation behavior on macOS endpoints. 🪟 Windows ClickFix and LOLBin detection coverage 🪟 Added four new Windows analytics covering remote connections through finger.exe, command execution through for /f loops, JavaScript execution by node.exe from unusual directories, and processes accessing the IronLanguages repository on GitHub. Together, these detections improve visibility into ClickFix-related execution chains, payload retrieval, scripting abuse, and the use of trusted utilities for malicious activity. 🔐 Improved credential-access and process-injection detection 🔐 Updated multiple detections leveraging the process access data source, covering LSASS access and termination, credential dumping, Winlogon token manipulation, Rubeus ticket export activity, handle duplication, and process injection. These changes improve analytic consistency, investigation context, and visibility into credential-access and defense-evasion techniques. 🛠️ Detection quality and metadata improvements 🛠️ Updated multiple analytics across application, endpoint, network, and web content. Changes include improved SPL logic, additional threat objects and references, better event context, and tuning intended to improve detection fidelity and reduce noise. Updates include coverage for ESXi tampering and VM termination, event-log clearing, Kerberos coercion, internal network scanning, and suspicious HTTP activity. New Analytics - [7] Cisco NVM - Osascript Network Connection for a Long Duration MacOS Osascript Executing Interactive Shell MacOS Osascript Executing JavaScript Code With ObjC Windows Finger.exe Connecting to a Remote Host Windows For Loop Usage Within Cmd.exe To Execute Commands Windows Node.exe Executing JS Script In Immediate Folder Windows Process Accessing IronLanguages Repository On GitHub Updated Analytics - [30] Cisco IOS XE WebUI Programmatic Configuration Creation of lsass Dump with Taskmgr CrushFTP Authentication Bypass Exploitation CrushFTP Max Simultaneous Users From IP DNS Kerberos Coercion Detect Credential Dumping through LSASS access ESXi Audit Tampering ESXi Bulk VM Termination Email files written outside of the Outlook directory Internal Horizontal Port Scan NMAP Top 20 Log4Shell JNDI Payload Injection Attempt Log4Shell JNDI Payload Injection with Outbound Connection Nginx ConnectWise ScreenConnect Authentication Bypass Plain HTTP POST Exfiltrated Data Prohibited Network Traffic Allowed Rubeus Kerberos Ticket Exports Through Winlogon Access Suspicious wevtutil Usage Unusually Long Content-Type Length Windows Access Token Manipulation Winlogon Duplicate Token Handle Windows Access Token Winlogon Duplicate Handle In Uncommon Path Windows Eventlog Cleared Via Wevtutil Windows Handle Duplication in Known UAC-Bypass Binaries Windows Possible Credential Dumping Windows Process Injection into Commonly Abused Processes Windows Terminating Lsass Process Windows Unsecured Outlook Credentials Access In Registry Windows Unusual File Creation in Confluence Directory Windows Vulnerable Driver Installed Windows WMI Impersonate Token Windows Wermgr Alternate Data Stream in Temp Dir Other Updates A special thanks to @0x4D6174696E from the Security Content community for reporting a bug in on piece of content that improved the quality and reliability of the security content. Breaking Changes List of detections scheduled for removal in ESCU version 6.10.0 Following is a list of detections scheduled for removal in ESCU version 6.10.0: Content Content Type Removed in Version Reason Replacement Content MacOS - Re-opened Applications Detection 6.10.0 D
First reported Sep 23, 2026 16:08 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights ESCU 6.0.0 is a major release that includes a number of changes for better alignment with Enterprise Security v8.x+ features. Please note that all content has been updated in this release, resulting in cleaner, more readable .conf files. 🔍Expanded Finding and Intermediate Finding Support 🔎 Detections that previously created Notable Events, and then Findings with a 0 score “N/A” entity will now create a Finding with an appropriately tagged entity from the search results, with the score that previously would have been used for a risk event/Intermediate Finding for that entity. Because of the shift to tagging entities to Findings, fewer total Intermediate Findings may be created for some detections, as we won’t be separately creating Intermediate Findings for every entity. 🗓️ Increased Clarity on Content Creation Date vs Modification Date 🗓️ Detections, Analytic Stories, and other things, depending on where you view them now have both creation and modification dates indicating when we first created them and when we’ve last modified them. 🛠️ Repository Tooling Updates 🛠️ ESCU v6.0 marks the transition away from contentctl. We are shifting future investment from contentctl to Detection Studio as we work to bring this functionality into Splunk as an officially supported capability. The contentctl repository will remain publicly available for reference, forking, and customization, but continued use may require customer-managed customization. For more information, see https://github.com/splunk/contentctl/blob/main/README.md Future Breaking Changes As previously communicated in ESCU v5.27.0, a number of detections will be removed in v6.1.0. For details on detections scheduled for removal in ESCU version v6.1.0, see the List of Detections Scheduled for Removal. List of detections scheduled for removal in ESCU version 6.1.0 Deprecated Detection Replacement Detection CHCP Command Execution Not Available Sc exe Manipulating Windows Services Not Available Processes launching netsh Not Available Ivanti Sentry Authentication Bypass Not Available Attempt To Add Certificate To Untrusted Store Not Available List of detections deprecated in ESCU version 6.0.0 Deprecated Detection Replacement Detection
First reported Jun 01, 2026 19:52 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights 🌐 Suspicious Network and Shell Activity 🌐 Introduced new analytics for browser-spawned Unix shells with external connections, uncommon and rare network connections from LOLBAS binaries, and suspicious Socat listener and remote TCP activity. This coverage helps defenders identify potential command execution, network tunneling, proxying, and command-and-control behavior originating from browsers or trusted system utilities. 🍎 macOS AppleScript and User Interaction 🍎 Added two macOS analytics covering AppleScript shell execution and compilation, as well as suspicious user prompts displayed through osascript. These detections improve visibility into script-based execution and potentially deceptive user interaction used to facilitate malicious activity on macOS endpoints. 🪟 Windows Account and Browser Activity 🪟 Expanded Windows coverage with detections for changes to built-in account names and execution of content copied from a browser. These analytics help identify account manipulation and suspicious execution workflows that may involve commands or payloads copied from web content. 🧩 SCCM Abuse Detection 🧩 Introduced two analytics focused on suspicious SCCM activity: DLL planting in the SMS Provider directory and abnormal child-process execution spawned by smsexec. This provides stronger visibility into potential abuse of SCCM components for execution, persistence, or lateral movement. 🔧 Cross-Platform Detection Refinements 🔧 Updated 18 analytics across Citrix, Windows, Linux, and macOS environments. The refinements improve coverage and detection fidelity for Citrix ADC exploitation, pipe-based execution, file and process activity, data destruction, Ghostscript exploitation, account creation, data chunking, network discovery, PowerShell, event-log manipulation, user and private-key discovery, credential access, and execution from suspicious paths. 🗂️ Detection and AI Risk Classification 🗂️ Together with NIST AI RMF Control Coverage dashboard, we’ve added the detection_subcategory_map and nist_ai_rmf_subcategories lookups to improve analytic categorization, detection metadata, and alignment with NIST AI Risk Management Framework subcategories. New Analytics - [12] Cisco NVM - Browser Spawned Unix Shell with External Connection LOLBAS Network Connection On Uncommon Port LOLBAS Rare Network Connection Linux Crontab Enumeration MacOS AppleScript Shell Execution and Compilation MacOS Osascript Displaying Suspicious User Prompt Socat Network Listener Binding an Executable Socat Remote TCP Connection with Local Echo Disabled Windows Builtin Account Name Was Changed Windows Content Copied from Browser was Executed Windows SCCM Adsource DLL Was Planted In SMS Provider Directory Windows SCCM Smsexec Spawned a Suspicious Child Process Updated Analytics - [18] Citrix ADC Exploitation CVE-2023-3519 File Download or Read to Pipe Execution Icacls Deny Command Jscript Execution Using Cscript App Linux Data Destruction Command Linux Ghostscript Exploitation MacOS Account Created MacOS Data Chunking Network Connection Discovery With Arp PowerShell 4104 Hunting Suspicious wevtutil Usage System User Discovery With Whoami Windows CAB File on Disk Windows Private Keys Discovery Windows Process Execution in Temp Dir Windows Suspicious Process File Path Windows TinyCC Shellcode Execution Windows Unusual SysWOW64 Process Run System32 Executable Other updates A new NIST AI RMF Control Coverage dashboard, available in alpha, maps AI-related ESCU detections and activity to the framework's Govern, Map, Measure, and Manage functions. This helps security teams identify coverage gaps and turn technical telemetry into clearer risk and governance insights. Two new lookups detection_subcategory_map, nist_ai_rmf_subcategories were added to support the NIST AI RMF Dashboard. A special thanks to @thegreatmhn and @munzzyy from the Security Content community for reporting bugs and proposing fixes tha
First reported Sep 10, 2026 14:55 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights 🔐 Expanded Active Directory and Windows threat coverage 🔐 Added four analytics for KerberLoss SPN manipulation, ResetNightmare-related UPN changes, and Windows Defender artifacts associated with ShieldCrash. These detections help identify suspicious account changes and exploitation activity. 🪟 Consolidated renamed-binary detection 🪟 Added four lookup-backed analytics covering renamed command interpreters, LOLBAS binaries, popular third-party software, and Python binaries. This replaces multiple separate searches with a smaller set of detections. ☁️ Improved support for current security data sources ☁️ Updated Office 365 message trace analytics to support the Microsoft 365 Graph sourcetype while retaining legacy support. Updates also improve CrowdStrike FDR compatibility and refine Azure AD consent and WMI event subscription detections. 🛠️ Detection quality and content improvements 🛠️ Updated 121 analytics and four macros, and added three lookup sets. Changes span Active Directory, cloud, endpoint, Cisco NVM, and Cisco Secure Firewall content, improving data handling, investigation context, and content maintainability. New Analytics - [8] Windows AD Computer SPN Modified By User Account Windows AD SPN Unicode Collision Injection Windows AD User Suspicious UPN Change Windows Defender Intermediary Artifact Was Observed Windows Renamed Command Interpreter was Executed Windows Renamed LOLBAS Binary was Executed Windows Renamed Popular 3rd Party Software was Executed Windows Renamed Python Binary was Executed Updated Analytics - [121] 3CX Supply Chain Attack Network Indicators Attacker Tools On Endpoint Azure AD OAuth Application Consent Granted By User Azure AD Privileged Role Assigned to Service Principal Azure AD Privileged Role Assigned Azure AD User Consent Blocked for Risky Application Circle CI Disable Security Job Cisco NVM - Browser Spawned Unix Shell with External Connection Cisco NVM - Curl Execution With Insecure Flags Cisco NVM - Installation of Typosquatted Python Package Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Cisco NVM - Non-Network Binary Making Network Connection Cisco NVM - Osascript Network Connection for a Long Duration Cisco NVM - Outbound Connection to Suspicious Port Cisco NVM - Rclone Execution With Network Activity Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Cisco NVM - Susp Script From Archive Triggering Network Activity Cisco NVM - Suspicious Download From File Sharing Website Cisco NVM - Suspicious File Download via Headless Browser Cisco NVM - Suspicious Network Connection From Process With No Args Cisco NVM - Suspicious Network Connection Initiated via MsXsl Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco NVM - Webserver Download From File Sharing Website Cisco Secure Firewall - Binary File Type Download Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall - Intrusion Events by Threat Activity Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall - Remote Access Software Usage Traffic Cisco Secure Firewall - Repeated Malware Downloads Cloud API Calls From Previously Unseen User Roles Cloud Compute Instance Created By Previously Unseen User Cloud Compute Instance Created In Previously Unused Region Cloud Compute Instance Created With Previously Unseen Image Cloud Compute Instance Created With Previously Unseen Instance Type Cloud Instance Modified By Previously Unseen User Cloud Provisioning Activity From Previously Unseen City Cloud Provisioning Activity From Previously Unseen Country Cloud Provisioning Activity From Previously Unseen IP Address Cloud Provisioning Activity From Previously Unseen Region Common Ransomware Extensions Detect Remote Access Software Usage DNS Detect Remote Access Software Usage FileInfo Detect Remote Access Software Usage File Detect Remote Access Soft
First reported Oct 08, 2026 22:47 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights ⭐ Starland RAT Campaign (UAT-11795) ⭐ Expanded detection coverage for the Starland RAT campaign attributed to UAT-11795, a financially motivated threat actor leveraging ClickFix social engineering and trojanized installers to deploy Starland RAT, the WLDR Agent PowerShell memory implant, and supporting malware including CastleStealer and Remcos RAT. This release tags a broad set of existing analytics covering PowerShell abuse, malicious script execution, persistence, reconnaissance, suspicious downloads, registry modifications, and Telegram-based C2 communications, improving visibility into the multi-stage infection chain, in-memory execution, credential theft, and resilient command-and-control techniques used throughout the campaign. 👀 Linux Exploitation Detection Expansion 👀 Expanded Linux detection coverage with new analytics focused on local privilege escalation, defense evasion, and kernel-level exploitation techniques, improving visibility into attempts to bypass security controls, abuse elevated execution paths, and exploit low-level system components commonly targeted by advanced adversaries. New Analytic Story - [1] Starland RAT Campaign New Analytics - [4] Linux Apparmor Bypass Via Aaexec Linux Auditd Possible Setuid Execve Privesc Linux Pedit Offset Out Of Bounds Windows AppCertDLL Modification Via Registry Updated Analytics - [67] AWS Bedrock Claude Unusually Large Prompts Attacker Tools On Endpoint Batch File Write to System32 Cisco NVM - Curl Execution With Insecure Flags Cisco NVM - Installation of Typosquatted Python Package Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI Cisco NVM - Non-Network Binary Making Network Connection Cisco NVM - Outbound Connection to Suspicious Port Cisco NVM - Rclone Execution With Network Activity Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download Cisco NVM - Susp Script From Archive Triggering Network Activity Cisco NVM - Suspicious Download From File Sharing Website Cisco NVM - Suspicious File Download via Headless Browser Cisco NVM - Suspicious Network Connection From Process With No Args Cisco NVM - Suspicious Network Connection Initiated via MsXsl Cisco NVM - Suspicious Network Connection to IP Lookup Service API Cisco NVM - Webserver Download From File Sharing Website Common Ransomware Extensions Common Ransomware Notes Detect HTML Help URL in Command Line Detect MSHTA Url in Command Line Detect RClone Command-Line Usage Domain Controller Discovery with Nltest Email files written outside of the Outlook directory Executables Or Script Creation In Suspicious Path LLM Model File Creation Linux Binary Launched Process with Null Argv Linux PF_ALG Registration Outside of Boot Window Local LLM Framework DNS Query Malicious PowerShell Process - Execution Policy Bypass PowerShell 4104 Hunting Recon AVProduct Through Pwh or WMI Registry Keys Used For Persistence Set Default PowerShell Execution Policy To Unrestricted or Bypass Short Lived Scheduled Task (External Contributor: @AndreiBanaru) Suspicious Process Executed From Container File Svchost LOLBAS Execution Process Spawn Time Provider Persistence Registry WMIC XSL Execution via URL Windows AppCertDLL Modification Via Command Line Windows Boot or Logon Autostart Execution In Startup Folder Windows Curl Download to Suspicious Path Windows Curl Upload to Remote Destination Windows DNS Query Request by Telegram Bot API Windows File Download Via CertUtil Windows File Download Via PowerShell Windows File Without Extension In Critical Folder Windows Gather Victim Network Info Through Ip Check Web Services Windows HTTP Network Communication From MSIExec Windows InstallUtil Remote Network Connection Windows InstallUtil URL in Command Line Windows Kerberos Local Successful Logon Windows Large Number of Computer Service Tickets Requested (External Contributor: @munzzyy) Windows Local LLM Framework Execution Windows MSI Rollback Script Deleted By Non-Msiexec Process Windows MSIEx
First reported Jul 29, 2026 14:34 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights 🚨 Linux Copy Fail Privilege Escalation (CVE-2026-31431): Added a new detection: Linux Auditd Copy Fail Privilege Escalation to identify exploitation of the Copy Fail vulnerability, a Linux kernel flaw that enables unprivileged users to perform controlled writes to file page cache and escalate privileges to root. This analytic leverages auditd telemetry to detect suspicious modification patterns targeting setuid binaries, providing early visibility into local privilege escalation attempts across affected Linux systems. 🔐 Cisco Secure Access Analytics: Introduced a new analytic story for Cisco Secure Access, leveraging firewall telemetry to detect suspicious access patterns. This release includes updates to existing detections: Large ICMP Traffic, Outbound SMB Traffic, Outbound LDAP Traffic, and Windows RDP Network Brute Force Attempts enabling them to operate with Cisco Secure Access Firewall data, validated through simulated attack scenarios to improve visibility into adversary activity traversing modern cloud-delivered security controls. 🪟 Windows Threat Detection Expansion: Significantly expanded coverage across multiple analytic stories with the addition of a broad set of new detections targeting modern Windows attack techniques, including PowerShell abuse, process injection, privilege escalation, registry manipulation, cloud and Azure activity, RMM tool usage, and C2 frameworks such as Cobalt Strike, Metasploit, and custom agents. These analytics enhance visibility into attacker behaviors like defense evasion (EDR bypass, obfuscation, EFI tampering), persistence (scheduled tasks, file association changes, GPO abuse), credential access (LAPS harvesting, keychain-like data access), and lateral movement and exfiltration, while also covering emerging tradecraft such as Cloudflared tunnels, Devtunnels, and supply chain tooling abuse—providing deeper detection across the Windows attack lifecycle. ⌨️ VIP Keylogger (.NET Stealer) Detection Coverage: Introduced new analytics to strengthen detection of VIP Keylogger and related .NET-based infostealers by focusing on behavioral indicators of stealthy execution and persistence. New detections: PowerShell Environment Variable Execution, Windows Anomalous Registry Value Length in Environment Key, PowerShell PInvoke Process Injection API Chain, and Windows Proxy Execution of .NET Utilities via Scripts surface patterns such as encoded payload staging in registry keys, script-driven execution of trusted .NET binaries, and in-memory process injection techniques, improving visibility into credential theft operations, obfuscated execution chains, and defense evasion commonly used in modern phishing-delivered stealer campaigns. New Analytic Story - [2] Cisco Secure Access Analytics VIP Keylogger New Analytics - [67] Linux Auditd Copy Fail Privilege Escalation PowerShell Environment Variable Execution PowerShell PInvoke Process Injection API Chain Windows .Key File Creation in Root Directory Windows Anomalous Registry Value Length in Environment Key Windows AppCertDLL Modification Via Command Line Windows Azure PowerShell Module Installation Via PowerShell Script Windows Azure Storage Utility Execution Via CLI Windows Cobalt Strike PowerShell Loader Windows Command Obfuscation with Environment Variable Substrings Windows Computer Account Changed to Domain Controller Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script Windows CrowdStrike Agent Registry Key Removal Windows Crowdstrike RTR Script Execution Windows Default Cobalt Strike PowerShell Beacon Windows Devtunnels Execution Windows Devtunnels Image Loaded Windows Downdate Registry Activity Windows EDRSilencer Execution Windows EFI Bootloader File Modification Windows EFI Volume Mount Attempt Via Mountvol Windows Entra User Management Via Azure CLI Windows File Association Modification via Ftype Windows Filtering Platform Policy Added to Block EDR Process Windows Get-Variable.EXE
First reported May 06, 2026 17:51 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
🚀 Key Highlights 🏴 Linux Dirty Frag Privilege Escalation (CVE-2026-43284 & CVE-2026-43500) 🏴 Added a new detection for the Dirty Frag Linux kernel privilege escalation vulnerabilities, identifying the exploit's characteristic high-frequency splice() syscall activity followed by execution of a setuid binary within the same audit session. This analytic provides early visibility into attempts to corrupt the kernel page cache and escalate privileges to root through abuse of the IPsec ESP or RxRPC subsystems. 👻 Phantom Stealer 👻 Expanded detection coverage for this Windows information stealer that targets browser credentials, FTP/SSH clients, cryptocurrency wallets, and other sensitive application data. This release adds a new detection for unauthorized access to WinSCP security configuration folders while tagging and enhancing existing analytics covering browser credential theft, PowerShell abuse, process injection, persistence, suspicious browser behavior, and data exfiltration, improving visibility into credential harvesting and post-compromise activity commonly associated with modern infostealers. ⏫ Sysmon Event ID 8 Detection Improvements ⏫ Refined detection coverage built on Sysmon Event ID 8 (CreateRemoteThread) by aligning the data source with native Sysmon field mappings, updating analytics to use the correct raw field names, and reducing false positives through rule consolidation and deprecation of noisy content. This release also introduces a new detection — Windows Uncommon Remote Thread Creation in Browser Process — strengthening visibility into process injection techniques while improving the accuracy and maintainability of existing CreateRemoteThread analytics. 🪨 AWS Bedrock Claude AI Security Analytics 🪨 Introduced a new analytic story for AWS Bedrock Claude focused on detecting prompt injection, jailbreak attempts, and suspicious AI interactions targeting enterprise generative AI workloads. This release adds analytics to identify cross-region inference abuse, excessive token consumption, high-risk filesystem and execution tool invocation, hostile prompt sentiment, prompt injection attempts, sensitive data exposure in prompts, and unusually large prompt submissions, providing security teams with visibility into attempts to bypass AI safety controls, manipulate model behavior, or misuse Claude-powered applications. New Analytic Story - [2] Phantom Stealer Suspicious AWS Bedrock Claude Activities New Analytics - [10] AWS Bedrock Claude Cross Region Possible Inference Abuse AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation AWS Bedrock Claude Hostile Prompt Sentiment AWS Bedrock Claude Possible Prompt Injection AWS Bedrock Claude Sensitive Data in Prompts AWS Bedrock Claude Unusually Large Prompts AWS Bedrock Claude excessive use of tokens Linux Dirty Frag Kernel Privilege Escalation Windows Uncommon Remote Thread Creation In Browser Process Windows WinSCP Configuration Security Access Updated Analytics - [53] Windows EDRSilencer Execution PetitPotam Suspicious Kerberos TGT Request Other Updates 🧱 PowerShell ScriptBlock Analytics Refinement 🧱 Updated the finding messages for detections leveraging the PowerShell ScriptBlock data source to improve readability by omitting oversized ScriptBlockText fields, while also converting these analytics to Anomaly detections and refining their descriptions for clearer triage. Content Scheduled for Removal in Future Releases Content Content Type Removed in Version Reason Replacement Content PowerShell - Connect To Internet With Hidden Window Detection 6.4.0 Detection has been deprecated due to incorrect logic and bad performance. None Regsvr32 with Known Silent Switch Cmdline Detection 6.4.0 Detection has been deprecated since its logic is already covered by another more improved detection. Regsvr32 Silent and Install Param Dll Loading Rundll32 CreateRemoteThread In Browser Detection 6.4.0 Detection has been deprec
First reported Jul 13, 2026 18:08 UTCCatalog metadata updated Oct 14, 2026 09:26 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.