Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
3 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
New libpng packages are available for Slackware 15.0 and -current to fix a security issue.
First reported Oct 01, 2026 00:56 UTCCatalog metadata updated Oct 13, 2026 07:35 UTCOpen evidence recordNew mutt packages are available for Slackware 15.0 and -current to fix security issues.
First reported Oct 09, 2026 23:30 UTCCatalog metadata updated Oct 13, 2026 07:35 UTCOpen evidence recordNew cups packages are available for Slackware 15.0 and -current to fix security issues.
First reported Oct 05, 2026 23:11 UTCCatalog metadata updated Oct 13, 2026 07:35 UTCOpen evidence recordI remember being in the room at DEF CON 23 in Las Vegas, in 2015, listening to "Let's Encrypt – Minting Free Certificates to Encrypt the Entire Web". It was still months before Let's Encrypt would launch their public beta and begin cementing 90-
First reported Oct 09, 2026 09:38 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordOn 27 August 2026, Manchester Airports Group told customers that "an unauthorised third party" had stolen their data. Car park bookings, lounge bookings, Fast Track purchases for airport security and passport control, along with airport WiFi sign-ups across Manchester, Stansted and East Midlands. Roughly 8.8 million
First reported Sep 07, 2026 09:13 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordA stolen session cookie can be vastly more powerful than a stolen password. The attacker doesn’t need to phish the user, bypass MFA, or defeat their passkey; they simply replay the cookie and step straight into a fully authenticated session. That’s why info-stealers love browser
First reported Jun 02, 2026 10:59 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordThis week, I published a blog post about Device Bound Session Credentials, a new technology that will significantly hamper the efforts of Infostealers and reduce the damage caused by stolen cookies. Today, we're announcing the beta of DBSC at Report URI!Device Bound Session CredentialsYou should definitely
First reported Jun 05, 2026 14:22 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordA single support ticket became the front door to 275 million student records. The Canvas breach shows how quickly untrusted user content can become a serious security incident when it is rendered inside privileged internal tooling. This was not an exotic attack chain; it was stored XSS, over-scoped access,
First reported Jun 15, 2026 12:21 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordConnection Allowlist is a new browser security mechanism that lets a document declare, up front, the exact set of destinations it's permitted to open network connections to. Anything not on the list is blocked by the browser before the connection leaves the machine. It's currently a
First reported Jul 08, 2026 16:11 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordWe’ve open-sourced dbsc-php, a small PHP library that makes it easier to deploy Device Bound Session Credentials and turn stolen session cookies into something far less useful. It's MIT-licensed, pure-PHP, and available on Packagist now!What is DBSC?If you'd
First reported Jun 08, 2026 14:00 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordEvery now and then I go digging through Report URI's Threat Intelligence data feeds, looking for domains that show up in CSP reports where they really shouldn't. Last week one jumped out at me: netdna-ssl.com. If you've been around the WordPress world
First reported Jun 24, 2026 13:11 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordBack in 2017, Troy Hunt and I built a little website called whynohttps.com. The idea was simple: take the most popular sites on the internet, check which ones still weren't redirecting visitors to HTTPS, and put the laggards on a list for everyone to see. No lecture,
First reported Jun 22, 2026 13:22 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordWe shipped Device Bound Session Credentials at Report URI, open-sourced the server-side implementation, and then discovered a long list of things the specification doesn't prepare you for.Some caused random logouts. One could deadlock a browser tab indefinitely. Two silently turned a device-bound session back
First reported Aug 10, 2026 16:06 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordDevice Bound Session Credentials (DBSC) is Chrome's answer to session cookie theft, usually by InfoStealer malware. Instead of a cookie being a bearer token that works anywhere it's pasted, DBSC binds the session to a private key that lives in your device's hardware and
First reported Aug 11, 2026 14:25 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordIt's been a long time since the last one of these! The previous Top 1 Million Analysis was way back in June 2022, and a lot has happened since then. But there's a much bigger reason to dust off the crawler and publish another report: this
First reported Jun 29, 2026 13:40 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordI recently went on an epic road trip around Europe, covering 1,645 miles (2,647 km), and we took in some amazing sights and locations. As a tech geek, I was worried about my connectivity on the trip, so before we set off, I came up with a plan!
First reported Aug 24, 2026 13:50 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordThis is part two of the ten-year anniversary Top 1 Million Analysis. Part one covered the broad state of the web — HTTPS, the security headers, cookies, email and DNS hygiene. This part is the bit I've been most excited to write: a focused look at the
First reported Jul 01, 2026 11:57 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordEvery other web platform feature I've ever written about, I've been able to test in some easy way. Open DevTools, type the name of the thing, see if it's there. Device Bound Session Credentials doesn't work like that: there is no way
First reported Aug 21, 2026 13:42 UTCCatalog metadata updated Oct 13, 2026 07:33 UTCOpen evidence recordNew Rules new: Axios NPM Compromise File Creation Indicators - Linux new: Axios NPM Compromise File Creation Indicators - MacOS new: Axios NPM Compromise File Creation Indicators - Windows new: Axios NPM Compromise Indicators - Linux new: Axios NPM Compromise Indicators - MacOS new: Axios NPM Compromise Indicators - Windows new: Axios NPM Compromise Malicious C2 Domain DNS Query new: Azure Sign-In With Axios User Agent new: Cisco Dot1x Disabled new: DMSA Link Attributes Modified new: DMSA Service Account Created in Specific OUs - PowerShell new: Google Workspace Government Attack Warning new: Google Workspace Out Of Domain Email Forwarding new: HackTool - NetExec File Indicators new: Hacktool - NetExec Execution new: Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet new: Inbox Rules Creation Or Update Activity in O365 new: Indirect Command Execution via SFTP ProxyCommand new: Kubernetes Potential Enumeration Activity new: LiteLLM / TeamPCP Supply Chain Attack Indicators new: Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet new: New DMSA Service Account Created in Specific OUs new: New MsDS-DelegatedManagedServiceAccount (DMSA) Object Created new: Notepad++ Updater DNS Query to Uncommon Domains new: Okta Session Impersonation Granted From Untrusted Domain new: OpenEDR Spawning Command Shell new: PUA - Memory Dump Mount Via MemProcFS new: Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI new: Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 new: Potential Vcruntime140 DLL Sideloading new: Potentially Suspicious File Creation by OpenEDR's ITSMService new: Python Base64 Encoded Inline Command Execution - Linux new: Python Base64 Encoded Inline Command Execution - Windows new: RedSun - Conhost.exe Spawned by TieringEngineService.exe new: RedSun - Named Pipe Created new: RedSun - TieringEngineService.exe Detected as EICAR Test File new: RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir new: Script Interpreter Spawning Credential Scanner - Linux new: Script Interpreter Spawning Credential Scanner - Windows new: Sensitive File Dump Via Print.EXE new: Service Startup Type Change Via Wmic.EXE new: Shai-Hulud 2.0 Malicious NPM Package Installation new: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux new: Shai-Hulud Malicious Bun Execution new: Shai-Hulud Malicious Bun Execution - Linux new: Shai-Hulud Malware Indicators - Linux new: Shai-Hulud Malware Indicators - Windows new: Suspicious Child Process of Notepad++ Updater - GUP.Exe new: Suspicious Child Process of SolarWinds WebHelpDesk new: Suspicious Email Delivered In Microsoft 365 new: Suspicious Login Activity Classified By Google new: System Language Discovery via Reg.Exe new: System Restore Registry Modification via CommandLine new: TeamPCP LiteLLM Supply Chain Attack Persistence Indicators new: Uncommon File Created by Notepad++ Updater Gup.EXE new: Windows EventLog Autologger Session Registry Modification Via CommandLine new: msDS-ManagedAccountPrecededByLink Attribute Modified Updated Rules update: BPFDoor Abnormal Process ID or Lock File Accessed - add new file paths from Rapid7 research to increase coverage update: Csc.EXE Execution Form Potentially Suspicious Parent - Update regex to use a non-capturing group update: Delete Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Disable Important Scheduled Task - Add OFN and remove unecessary string binding for increased coverage. update: Dynamic .NET Compilation Via Csc.EXE - Update regex to use a non-capturing group update: Files With System Process Name In Unsuspected Locations - Add fsquirt.exe entry update: Github Delete Action Invoked - Rename action from 'codespaces.delete' to 'codespaces.destroy' update: Important Scheduled Task Deleted or Disabled - Add EventID 142. update: Invoke-Obfuscation Obfuscated IEX Invocation - Update regex to use a non-capturing group up
First reported Apr 28, 2026 11:32 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordNew Rules new: Azure Login Bypassing Conditional Access Policies new: CVE-2024-49113 Exploitation Attempt - LDAP Nightmare new: Suspicious Binaries and Scripts in Public Folder new: Suspicious Invocation of Shell via Rsync new: Windows Event Log Access Tampering Via Registry Updated Rules update: Exploit Framework User Agent - Add default Havoc C2 UA update: Renamed Powershell Under Powershell Channel - Update regex to use \s+ to account for different parsers update: Shell Execution via Rsync - Linux - Rework logic to make it more generic and include additional shells. update: Suspicious Non PowerShell WSMAN COM Provider - Update regex to use \s+ to account for different parsers update: Suspicious Windows Service Tampering - Add additional services Removed / Deprecated Rules remove: Windows Defender Exclusion Deleted Fixed Rules fix: BITS Transfer Job With Uncommon Or Suspicious Remote TLD - Add dn.onenote.net/ and cdn.office.net/ fix: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation - Add filter for Kaspersky and mDNS Responder fix: Failed Code Integrity Checks - Add filters for CrowdStrike. fix: Forest Blizzard APT - Process Creation Activity - prepend SHA256 to hash value fix: HackTool - Dumpert Process Dumper Execution - prepend MD5 to hash value fix: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse - prepend IMPHASH to hash value fix: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation - Add filter for \Windows\SoftwareDistribution\Download\ fix: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load - Add exclusion filter C:\ProgramData\Package Cache\{ to account for cases like the execution of vcredist fix: Privileged User Has Been Created - Add missing comma to avoid false positives fix: Relevant Anti-Virus Signature Keywords In Application Log - Enhances the HTool string to avoid unintended matches. fix: Renamed Powershell Under Powershell Channel - Add edge case filters for double backslashes PowerShell invocation. fix: Renamed ZOHO Dctask64 Execution - prepend IMPASH to hash value fix: Uncommon AppX Package Locations - Add https://installer.teams.static.microsoft/ fix: WCE wceaux.dll Access - Remove EventIDs 4658 and 4660 as they both do not contain the ObjectName field Acknowledgement Thanks to @DanielKoifman, @defensivedepth, @djlukic, @frack113, @GtUGtHGtNDtEUaE, @joshnck, @krdmnbrk, @nasbench, @Neo23x0, @samuelmonsempessenthorus, @Ti-R, @tsale, @X-Junior for their contribution to this release Which Sigma rule package should I use? A detailed explanation can be found in the Releases.md file. If you are new to Sigma, we recommend starting with the "Core" ruleset. The latest release package on GitHub can always be found here.
First reported Feb 03, 2025 17:34 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordNew Rules new: Antivirus - APT Malware Signature new: Antivirus - Remote Access Tools Signature new: AppLocker Application Would Have Been Blocked new: Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator new: Curl File Upload To File Sharing Websites new: Failed Event Log Clear Via WMI NTEventLogFile ClearEventLog new: LSASS Crash Via Netlogon Stack Buffer Overflow - CVE-2026-41089 new: Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator new: NTLM Hash Leak Via Curl NTLM Authentication new: New Agent Skills Installation Attempt Via Node.EXE new: Process Execution from Shared Memory Directory new: RedTail Cryptominer User-Agent new: Registry Enumeration via WMI Stdregprov new: Signed DLL Loaded With Missing PE Version Metadata new: TanStack Supply-Chain Attack DNS Indicators new: TanStack Supply-Chain Attack Execution Indicators - Linux new: TanStack Supply-Chain Attack Execution Indicators - Windows new: TanStack Supply-Chain Attack File Creation Indicators - Linux new: TanStack Supply-Chain Attack File Creation Indicators - Windows new: Windows Defender Disabled Via SystemSettingsAdminFlows.EXE Updated Rules update: 7Zip Compressing Dump Files - Add missing 7zr.exe OriginalFileName entries update: Amsi.DLL Load By Uncommon Process - add ARM64 (*64a.exe) variant update: Antivirus - Exploitation Framework Signature - add multiple new strings update: Antivirus - Hacktool Signature - add multiple new strings update: Antivirus - Password Dumper Signature - add multiple new strings update: Antivirus - Ransomware Signature - add multiple new strings update: Antivirus - Relevant File Paths Alerts Signature - change to new style title update: Antivirus - Web Shell Detection Signature - change to new style title update: Application Termination Attempt Via Wmic.EXE - rename, expand description update: BITS Transfer Job Download From File Sharing Domains - add more file sharing domains update: Compress Data and Lock With Password for Exfiltration With 7-ZIP - Add missing 7zr.exe OriginalFileName entries update: CredUI.DLL Loaded By Uncommon Process - add ARM64 (*64a.exe) variant update: HackTool - SysmonEnte Execution - add ARM64 (*64a.exe) variant update: Legitimate Application Dropped Executable - add .pyc, .jar extensions update: Legitimate Application Dropped Script - add various scripts extensions update: Local System Accounts Discovery - MacOs - Re-work logic to enhance coverage and fix incorrect assumptions update: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - add more file sharing domains update: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - add more file sharing domains update: New Connection Initiated To Potential Dead Drop Resolver Domain - add more file sharing domains update: NewActiveScriptEventConsumer Creation Attempt Via Wmic.EXE - rename, expand description, add OriginalFileName to detection update: Password Protected Compressed File Extraction Via 7Zip - Add missing 7zr.exe OriginalFileName entries update: Permission Check Via Accesschk.EXE - add ARM64 (*64a.exe) variant update: Potential Credential Dumping Activity Via LSASS - add ARM64 (*64a.exe) variant update: Potential Defense Evasion Via Binary Rename - Add missing 7zr.exe OriginalFileName entries update: Potential Defense Evasion Via Rename Of Highly Relevant Binaries - add ARM64 (*64a.exe) variant update: Potential Privileged System Service Operation - SeLoadDriverPrivilege - add ARM64 (*64a.exe) variant update: Potential Process Reconnaissance Via Wmic.EXE - rename, expand description, add discovery tags, add terminate filter update: Potential WinAPI Calls Via PowerShell Scripts - add local shellcode injection patterns update: Potentially Suspicious AccessMask Requested From LSASS - add ARM64 (*64a.exe) variant update: Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE - add more file sharing do
First reported Jul 09, 2026 14:51 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordNew Rules new: AWS Bucket Deleted new: AWS Console Login Monitoring new: AWS ConsoleLogin Failed Authentication new: AWS EnableRegion Command Monitoring new: AWS IAM user with Console Access Login Without MFA (#5074) new: AWS KMS Imported Key Material Usage new: AWS STS GetCallerIdentity Enumeration Via TruffleHog new: AWS VPC Flow Logs Deleted new: Audit Rules Deleted Via Auditctl new: BaaUpdate.exe Suspicious DLL Load new: FTP Connection Open Attempt Via Winscp CLI new: File Access Of Signal Desktop Sensitive Data new: GitHub Repository Archive Status Changed new: GitHub Repository Pages Site Changed to Public new: Hacktool - EDR-Freeze Execution new: IIS WebServer Log Deletion via CommandLine Utilities new: ISATAP Router Address Was Set new: Installation of WSL KaliLinux new: Kaspersky Endpoint Security Stopped Via CommandLine - Linux new: Linux Sudo Chroot Execution new: Mask System Power Settings Via Systemctl new: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation new: PUA - Restic Backup Tool Execution new: Potential Executable Run Itself As Sacrificial Process new: Potential Exploitation of GoAnywhere MFT vulnerability new: Potential Lateral Movement via Windows Remote Shell new: Python WebServer Execution - Linux new: RunMRU Registry Key Deletion new: RunMRU Registry Key Deletion - Registry new: Suspicious BitLocker Access Agent Update Utility Execution (#5502) new: Syslog Clearing or Removal Via System Utilities new: Unsigned or Unencrypted SMB Connection to Share Established new: WFP Filter Added via Registry new: WSL Kali Linux Usage new: WinRAR Creating Files in Startup Locations new: Winrs Local Command Execution new: Winscp Execution From Non Standard Folder Updated Rules update: ASLR Disabled Via Sysctl or Direct Syscall - Linux - Add sysctl option update: AWS Successful Console Login Without MFA - only alert on successful logins update: Account Tampering - Suspicious Failed Logon Reasons - add SubStatus field update: Blackbyte Ransomware Registry - move to rules-emerging-threats folder update: Local Accounts Discovery - add OriginalFileName field update: Modify System Firewall - add nftables delete/flush update: PFX File Creation - Enhance filters, metadata and logic update: Potential LSASS Process Dump Via Procdump - expand flags and service-names detection update: Potentially Suspicious JWT Token Search Via CLI - add selection for common search tools update: PowerShell Download Pattern - add powershell_ise update: Powershell Token Obfuscation - Powershell - Move to the TH folder in order to set the right FP expectations. update: Suspicious C2 Activities - update definition (#5142) update: Suspicious Process Suspension via WERFaultSecure through EDR-Freeze - refine image path logic and include OriginalFileName for improved rule accuracy update: Suspicious Startup Folder Persistence: add more suspicious extensions update: Use Short Name Path in Image - change detection logic structure update: WinRAR Execution in Non-Standard Folder - update PE metadata Removed / Deprecated Rules remove: Active Directory Parsing DLL Loaded Via Office Application - deprecated as this rule was triggered everytime any office app was opened remove: Azure Application Credential Modified - superseeded by cbb67ecc-fb70-4467-9350-c910bdf7c628 remove: PowerShell DownloadFile - Deprecated in favour of 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 remove: Whoami Utility Execution - Deprecated in favor of 502b42de-4306-40b4-9596-6f590c81f073 Fixed Rules fix: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE - filter hexnode fix: Alternate PowerShell Hosts - PowerShell Module - filter out more legit powershell host fix: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE - remove + characters from selectors fix: CurrentVersion Autorun Keys Modification - Add more filters for OneDriverSetup.EXE fix: CurrentVersion NT Autorun Keys Modification - filter svchost making legitimate registry change fix: F
First reported Oct 29, 2025 11:28 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordNew Rules new: AMSI Disabled via Registry Modification new: Cmd Launched with Hidden Start Flags to Suspicious Targets new: Devcon Execution Disabling VMware VMCI Device new: Github Self-Hosted Runner Execution new: HTML File Opened From Download Folder new: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine new: Legitimate Application Writing Files In Uncommon Location new: Linux Setgid Capability Set on a Binary via Setcap Utility new: Linux Setuid Capability Set on a Binary via Setcap Utility new: Linux Suspicious Child Process From Node.js - React2Shell new: OpenCanary - Host Port Scan (SYN Scan) new: OpenCanary - NMAP FIN Scan new: OpenCanary - NMAP NULL Scan new: OpenCanary - NMAP OS Scan new: OpenCanary - NMAP XMAS Scan new: OpenCanary - RDP New Connection Attempt new: PUA - Kernel Driver Utility (KDU) Execution new: Registry Modification for OCI DLL Redirection new: Successful MSIX/AppX Package Installation new: Suspicious ArcSOC.exe Child Process new: Suspicious File Created by ArcSOC.exe new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs new: Suspicious Shell Open Command Registry Modification new: User Shell Folders Registry Modification via CommandLine new: Vulnerable Driver Blocklist Registry Tampering Via CommandLine new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze new: Windows AMSI Related Registry Tampering Via CommandLine new: Windows AppX Deployment Full Trust Package Installation new: Windows AppX Deployment Unsigned Package Installation new: Windows Credential Guard Disabled - Registry new: Windows Credential Guard Registry Tampering Via CommandLine new: Windows Credential Guard Related Registry Value Deleted - Registry new: Windows MSIX Package Support Framework AI_STUBS Execution new: Windows Suspicious Child Process From Node.js - React2Shell new: Windows Vulnerable Driver Blocklist Disabled Updated Rules update: ASLR Disabled Via Sysctl or Direct Syscall - Linux - Updated syscall field to SYSCALL in order to make use of enriched logs update: AppX Located in Uncommon Directory Added to Deployment Pipeline - Enhance selection criteria update: Audio Capture - Updated syscall field to SYSCALL in order to make use of enriched logs update: BITS Transfer Job Download From File Sharing Domains - add github.com update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - Updated syscall field to SYSCALL in order to make use of enriched logs update: Creation Of Non-Existent System DLL - Add new DLLs and update metadata update: Curl Web Request With Potential Custom User-Agent - add another curl supported flag for header update: DNS Query to External Service Interaction Domains - Changed modifier to endswith for better accuracy and add additional domains. update: Direct Autorun Keys Modification - remove User Shell Folder registry modification update: File Download Via Bitsadmin To A Suspicious Target Folder - add more susp locations update: Hacktool - EDR-Freeze Execution - add more coverage update: Malicious PowerShell Commandlets - PoshModule - add Invoke-DNSExfiltrator update: Malicious PowerShell Commandlets - ProcessCreation - add Invoke-DNSExfiltrator update: Malicious PowerShell Commandlets - ScriptBlock - add Invoke-DNSExfiltrator update: Malicious PowerShell Scripts - FileCreation - add Invoke-DNSExfiltrator update: Malicious PowerShell Scripts - PoshModule - add Invoke-DNSExfiltrator update: Modify User Shell Folders Startup Value - add new registry path, also add filtering of legit paths update: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder - add github.com update: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location - add github.com update: Potential DLL Sideloading Of Non-Existent DLLs From Sy
First reported Jan 29, 2026 12:57 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordNew Rules new: Attempts of Kerberos Coercion Via DNS SPN Spoofing new: BITS Client BitsProxy DLL Loaded By Uncommon Process new: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall new: DNS Query To Common Malware Hosting and Shortener Services new: DNS Query To Katz Stealer Domains new: DNS Query To Katz Stealer Domains - Network new: Disable ASLR Via Personality Syscall - Linux new: FileFix - Command Evidence in TypedPaths from Browser File Upload Abuse new: FileFix - Suspicious Child Process from Browser File Upload Abuse new: HKTL - SharpSuccessor Privilege Escalation Tool Execution new: HackTool - Doppelanger LSASS Dumper Execution new: HackTool - HollowReaper Execution new: HackTool - Impacket File Indicators new: Katz Stealer DLL Loaded new: Katz Stealer Suspicious User-Agent new: MSSQL Destructive Query new: Obfuscated PowerShell MSI Install via WindowsInstaller COM new: Potential AS-REP Roasting via Kerberos TGT Requests new: Potential Abuse of Linux Magic System Request Key new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load new: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access new: Potential Java WebShell Upload in SAP NetViewer Server new: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation new: Potential Notepad++ CVE-2025-49144 Exploitation new: Potential SAP NetViewer Webshell Command Execution new: PowerShell MSI Install via WindowsInstaller COM From Remote Location new: Proxy Execution via Vshadow - detect invocation of vshadow.exe with -exec to spot hidden malware execution new: RegAsm.EXE Execution Without CommandLine Flags or Files new: Registry Export of Third-Party Credentials new: Remote Access Tool - Potential MeshAgent Usage - MacOS new: Remote Access Tool - Potential MeshAgent Usage - Windows new: Remote Access Tool - Suspicious MeshAgent Usage - MacOS new: Remote Access Tool - Suspicious MeshAgent Usage - Windows new: Special File Creation via Mknod Syscall new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing new: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network new: Suspicious Deno File Written from Remote Source new: Suspicious Download and Execute Pattern via Curl/Wget new: Suspicious File Access to Browser Credential Storage new: System Info Discovery via Sysinfo Syscall new: System Information Discovery via Registry Queries new: Trusted Path Bypass via Windows Directory Spoofing Updated Rules update: Access of Sudoers File Content - add more tools update: AspNetCompiler Execution - Add ARM version of the \Microsoft.NET path update: Audio Capture - use syscall name instead of id update: Cisco Modify Configuration - add "ntp server" keyword update: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall - use syscall name instead of id update: Commands to Clear or Remove the Syslog - detect journald vacuuming update: Disable ASLR Via Personality Syscall - Linux - use syscall name instead of id update: Disable Internal Tools or Feature in Registry - More registry modifications associated with feature change of windows internal tools added update: Enumeration for 3rd Party Creds From CLI - Updated the condition to update FP update: File Decoded From Base64/Hex Via Certutil.EXE - Increase level to high update: FileFix - Suspicious Child Process from Browser File Upload Abuse - add cmd.exe child process update: HackTool - LaZagne Execution: filter added to reduce FP and added more coverage through imphash update: Local Groups Discovery - Linux - add text output tools update: MSHTA Execution with Suspicious File Extensions - title changed and more susp extension added update: Malicious PowerShell Commandlets - PoshModule - Add BadSuccessor Exploit update: Malicious PowerShell Commandlets - PoshModule - add Invoke-PowerDPAPI update: Malicious PowerShell Commandlets - ProcessCreation - add Invo
First reported Jul 08, 2025 11:32 UTCCatalog metadata updated Oct 13, 2026 07:30 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.