GitHub Repo

Other Detections

Name Data Source Technique Type Analytic Story Date
CrushFTP Max Simultaneous Users From IP CrushFTP T1110.001 T1110.004 Anomaly CrushFTP Vulnerabilities 2026-09-08
CrushFTP Authentication Bypass Exploitation CrushFTP T1059.001 T1059.003 T1190 TTP Hellcat Ransomware, CrushFTP Vulnerabilities 2026-09-08
Gsuite suspicious calendar invite T1566 Hunting Spearphishing Attachments 2026-05-13
GitHub Organizations Disable Dependabot GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Enterprise Repository Archived GitHub Enterprise Audit Logs T1195 T1485 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Delete Branch Ruleset GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Disable IP Allow List GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GSuite Email Suspicious Attachment G Suite Gmail T1566.001 Anomaly Dev Sec Ops 2026-05-13
Gsuite Suspicious Shared File Name G Suite Drive T1566.001 Anomaly Dev Sec Ops 2026-05-13
GitHub Enterprise Remove Organization GitHub Enterprise Audit Logs T1195 T1485 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Organizations Repository Archived GitHub Organizations Audit Logs T1195 T1485 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Disable 2FA Requirement GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Enterprise Repository Deleted GitHub Enterprise Audit Logs T1195 T1485 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
Gsuite Outbound Email With Attachment To External Domain G Suite Gmail T1048.003 Hunting Insider Threat, Dev Sec Ops 2026-05-13
Gsuite Drive Share In External Email G Suite Drive T1567.002 Anomaly Insider Threat, Dev Sec Ops, Scattered Lapsus$ Hunters 2026-05-13
GitHub Organizations Delete Branch Ruleset GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Organizations Disable 2FA Requirement GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Organizations Disable Classic Branch Protection Rule GitHub Organizations Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Organizations Repository Deleted GitHub Organizations Audit Logs T1195 T1485 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Register Self Hosted Runner GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
Gdrive suspicious file sharing T1566 Hunting Scattered Lapsus$ Hunters, Spearphishing Attachments, Data Exfiltration 2026-05-13
GitHub Enterprise Disable Classic Branch Protection Rule GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
GitHub Enterprise Disable Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Disable Dependabot GitHub Enterprise Audit Logs T1195 T1685 Anomaly GitHub Malicious Activity 2026-05-13
Gsuite Email Suspicious Subject With Attachment G Suite Gmail T1566.001 Anomaly Dev Sec Ops 2026-05-13
GitHub Enterprise Modify Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
GitHub Enterprise Pause Audit Log Event Stream GitHub Enterprise Audit Logs T1195 T1685.002 Anomaly GitHub Malicious Activity, NPM Supply Chain Compromise 2026-05-13
Cisco Isovalent - Late Process Execution Cisco Isovalent Process Exec T1543 Anomaly Cisco Isovalent Suspicious Activity 2026-05-13
Crowdstrike Admin With Duplicate Password T1110 TTP Compromised Windows Host 2026-05-13
Crowdstrike Admin Weak Password Policy T1110 TTP Compromised Windows Host 2026-05-13
Detect Baron Samedit CVE-2021-3156 Segfault T1068 TTP Baron Samedit CVE-2021-3156 2026-05-13
Cisco Isovalent - Shell Execution Cisco Isovalent Process Exec T1543 Anomaly Cisco Isovalent Suspicious Activity 2026-05-13
Crowdstrike User with Duplicate Password T1110 Anomaly Compromised Windows Host 2026-05-13
Crowdstrike Medium Identity Risk Severity T1110 TTP Compromised Windows Host 2026-05-13
Microsoft Defender ATP Alerts MS Defender ATP Alerts N/A TTP Critical Alerts 2026-05-13
Crowdstrike User Weak Password Policy T1110 Anomaly Compromised Windows Host 2026-05-13
Detect Baron Samedit CVE-2021-3156 T1068 TTP Baron Samedit CVE-2021-3156 2026-05-13
Cisco Isovalent - Access To Cloud Metadata Service Cisco Isovalent Process Connect T1552.005 Anomaly VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity 2026-05-13
Cisco Isovalent - Potential Escape to Host Cisco Isovalent Process Exec T1611 Anomaly VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity 2026-05-13
MOVEit Empty Key Fingerprint Authentication Attempt T1190 Hunting MOVEit Transfer Authentication Bypass, Hellcat Ransomware 2026-05-13
Cisco Isovalent - Non Allowlisted Image Use Cisco Isovalent Process Exec T1204.003 Anomaly Cisco Isovalent Suspicious Activity 2026-05-13
Crowdstrike Privilege Escalation For Non-Admin User T1110 Anomaly Compromised Windows Host 2026-05-13
PaperCut NG Suspicious Behavior Debug Log T1133 T1190 Hunting PaperCut MF NG Vulnerability 2026-05-13
Cisco Isovalent - Pods Running Offensive Tools Cisco Isovalent Process Exec T1204.003 Anomaly Cisco Isovalent Suspicious Activity 2026-05-13
Crowdstrike High Identity Risk Severity T1110 TTP Compromised Windows Host 2026-05-13
Detect Baron Samedit CVE-2021-3156 via OSQuery T1068 TTP Baron Samedit CVE-2021-3156 2026-05-13
Crowdstrike Medium Severity Alert T1110 Anomaly Compromised Windows Host 2026-05-13
Processes Tapping Keyboard Events Osquery Results N/A TTP ColdRoot MacOS RAT, APT37 Rustonotto and FadeStealer 2026-05-13
MOVEit Certificate Store Access Failure T1190 Hunting MOVEit Transfer Authentication Bypass 2026-05-13
CrowdStrike Falcon Stream Alerts CrowdStrike Falcon Stream Alert N/A Anomaly Critical Alerts 2026-05-13
Suspicious PlistBuddy Usage via OSquery Osquery Results T1543.001 TTP Silver Sparrow 2026-05-13
Cisco Isovalent - Kprobe Spike Cisco Isovalent Process Kprobe T1068 Hunting VoidLink Cloud-Native Linux Malware, Cisco Isovalent Suspicious Activity 2026-05-13
Cisco Isovalent - Curl Execution With Insecure Flags Cisco Isovalent Process Exec T1105 Anomaly Cisco Isovalent Suspicious Activity 2026-10-02
Microsoft Defender Incident Alerts MS365 Defender Incident Alerts N/A TTP Critical Alerts 2026-05-13
Crowdstrike Multiple LOW Severity Alerts T1110 Anomaly Compromised Windows Host 2026-05-13
Cisco Isovalent - Cron Job Creation Cisco Isovalent Process Exec T1053.003 T1053.007 Anomaly Cisco Isovalent Suspicious Activity 2026-05-13
Detect ARP Poisoning Cisco IOS Logs T1200 T1498 T1557.002 TTP Router and Infrastructure Security 2026-05-13
Detect Traffic Mirroring Cisco IOS Logs T1020.001 T1200 T1498 TTP Router and Infrastructure Security 2026-05-13
Detect Port Security Violation Cisco IOS Logs T1200 T1498 T1557.002 TTP Router and Infrastructure Security 2026-05-13
Detect SNICat SNI Exfiltration T1041 TTP Data Exfiltration 2026-05-13
Cisco SD-WAN - Low Frequency Rogue Peer Cisco SD-WAN NTCE 1000001 T1190 Anomaly Cisco Catalyst SD-WAN Analytics 2026-05-13
Cisco SD-WAN - Peering Activity Cisco SD-WAN NTCE 1000001 T1190 Hunting Cisco Catalyst SD-WAN Analytics 2026-05-13
Detect Rogue DHCP Server Cisco IOS Logs T1200 T1498 T1557 TTP Router and Infrastructure Security, Scattered Lapsus$ Hunters 2026-05-13
Ollama Possible Memory Exhaustion Resource Abuse Ollama Server T1499 Anomaly Suspicious Ollama Activities 2026-10-09
Cisco AI Defense Repeated High Risk Activity Cisco AI Defense Alerts N/A TTP Abuse of GenAI Systems and Applications, Critical Alerts 2026-10-15
CrushFTP Server Side Template Injection CrushFTP T1190 TTP Hellcat Ransomware, CrushFTP Vulnerabilities 2026-05-13
Zoom Rare Input Devices T1123 Hunting Remote Employment Fraud 2026-05-13
MCP Prompt Injection MCP Server T1059 TTP Suspicious MCP Activities 2026-05-13
Cisco IOS XE Tunnel Interface Configuration Cisco IOS Logs T1090 T1572 Anomaly Salt Typhoon 2026-05-20
Ollama Possible API Endpoint Scan Reconnaissance Ollama Server T1595 Anomaly Suspicious Ollama Activities 2026-10-09
MCP Github Suspicious Operation MCP Server T1552.001 Hunting Suspicious MCP Activities 2026-05-13
MCP Filesystem Server Suspicious Extension Write MCP Server T1059 Hunting Suspicious MCP Activities 2026-05-13
Zoom Rare Video Devices T1123 Hunting Remote Employment Fraud 2026-05-13
M365 Copilot Jailbreak Attempts M365 Exported eDiscovery Prompts T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
Cisco ASA - Device File Copy Activity Cisco ASA Logs T1005 T1530 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
ESXi Syslog Config Change VMWare ESXi Syslog T1690 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Cisco Duo Policy Allow Old Flash Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi VM Discovery VMWare ESXi Syslog T1673 TTP Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity 2026-05-13
Cisco ASA - Reconnaissance Command Activity Cisco ASA Logs T1082 T1590.001 T1590.005 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
M365 Copilot Agentic Jailbreak Attack M365 Exported eDiscovery Prompts T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
ESXi VIB Acceptance Level Tampering VMWare ESXi Syslog T1685 TTP Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity 2026-05-13
Cisco Duo Admin Login Unusual Country Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - User Privilege Level Change Cisco ASA Logs T1078.003 T1098 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco Duo Bulk Policy Deletion Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Policy Allow Tampered Devices Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi System Information Discovery VMWare ESXi Syslog T1082 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
ESXi Reverse Shell Patterns VMWare ESXi Syslog T1059 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
ESXi VM Exported via Remote Tool VMWare ESXi Syslog T1005 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
M365 Copilot Impersonation Jailbreak Attack M365 Exported eDiscovery Prompts T1685 TTP Suspicious Microsoft 365 Copilot Activities 2026-06-04
Cisco IOS XE VTY Access Class Tampering Cisco IOS Logs T1021 T1562 Anomaly Salt Typhoon 2026-05-20
Ollama Long-Running Inference Requests Ollama Server N/A Anomaly Suspicious Ollama Activities 2026-10-10
Ollama Repeated Application Errors Ollama Server N/A Anomaly Suspicious Ollama Activities 2026-10-19
ESXi Account Modified VMWare ESXi Syslog T1078 T1098 T1136.001 Anomaly Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Cisco ASA - User Account Lockout Threshold Exceeded Cisco ASA Logs T1110.001 T1110.003 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco ASA - Logging Message Suppression Cisco ASA Logs T1070 T1685.001 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
MCP Sensitive System File Search MCP Server T1552.001 Hunting Suspicious MCP Activities 2026-05-13
PingID Mismatch Auth Source and Verification Response PingID T1098.005 T1556.006 T1621 TTP Compromised User Account 2026-05-13
Cisco SD-WAN Multiple SSH key Authentication from Same Source Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
ESXi Sensitive Files Accessed VMWare ESXi Syslog T1003.008 T1005 TTP Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity 2026-05-13
Cisco Duo Policy Deny Access Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi User Granted Admin Role VMWare ESXi Syslog T1078 T1098 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Zoom Rare Audio Devices T1123 Hunting Remote Employment Fraud 2026-05-13
M365 Copilot Application Usage Pattern Anomalies M365 Copilot Graph API T1078 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
PingID New MFA Method Registered For User PingID T1098.005 T1556.006 T1621 TTP Compromised User Account 2026-05-13
ESXi Lockdown Mode Disabled VMWare ESXi Syslog T1685 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
ESXi SSH Enabled VMWare ESXi Syslog T1021.004 TTP Black Basta Ransomware, Hellcat Ransomware, ESXi Post Compromise 2026-05-13
Cisco IOS XE Guestshell Activation and Destroy Cisco IOS Logs T1059 T1611 Anomaly Salt Typhoon 2026-05-20
Cisco IOS XE Reconnaissance Command Activity Cisco IOS Logs T1016 T1082 T1590 Anomaly Salt Typhoon 2026-05-20
Cisco Duo Admin Login Unusual Os Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Policy Skip 2FA for Other Countries Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - Device File Copy to Remote Location Cisco ASA Logs T1005 T1041 T1048.003 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco IOS XE Remote Access Probe Burst Cisco IOS Logs T1018 T1021.004 T1046 Anomaly Salt Typhoon 2026-05-20
ESXi Download Errors VMWare ESXi Syslog T1601.001 T1685 Anomaly Black Basta Ransomware, ESXi Post Compromise 2026-05-13
PingID New MFA Method After Credential Reset PingID T1098.005 T1556.006 T1621 TTP Compromised User Account, Scattered Lapsus$ Hunters 2026-09-29
Ivanti VTM New Account Creation Ivanti VTM Audit T1190 TTP Ivanti Virtual Traffic Manager CVE-2024-7593, Hellcat Ransomware, Scattered Lapsus$ Hunters 2026-05-13
ESXi SSH Brute Force VMWare ESXi Syslog T1110 Anomaly Black Basta Ransomware, Hellcat Ransomware, ESXi Post Compromise 2026-05-13
M365 Copilot Failed Authentication Patterns M365 Copilot Graph API T1110 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
ESXi Loghost Config Tampering VMWare ESXi Syslog T1685 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Cisco ASA - Packet Capture Activity Cisco ASA Logs T1040 T1557 Anomaly ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco ASA - Logging Disabled via CLI Cisco ASA Logs T1685 TTP Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Zoom High Video Latency T1078 Anomaly Remote Employment Fraud 2026-05-13
Cisco ASA - New Local User Account Created Cisco ASA Logs T1078.003 T1136.001 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco Duo Set User Status to Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco Duo Policy Allow Devices Without Screen Lock Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
ESXi Shell Access Enabled VMWare ESXi Syslog T1021 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal Cisco IOS Logs T1070.001 T1562 Anomaly Salt Typhoon 2026-05-20
ESXi Malicious VIB Forced Install VMWare ESXi Syslog T1505.006 TTP Black Basta Ransomware, ESXi Post Compromise, China-Nexus Threat Activity 2026-05-13
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication Cisco SD-WAN Auth Log T1595 Hunting Cisco Catalyst SD-WAN Analytics 2026-06-09
Cisco ASA - Logging Filters Configuration Tampering Cisco ASA Logs T1685 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
ESXi Audit Tampering VMWare ESXi Syslog T1070 T1690 TTP Black Basta Ransomware, ESXi Post Compromise 2026-09-08
PTC Windchill Gateway Command Execution Windchill Log4j T1005 T1059 T1190 Anomaly PTC Windchill Exploitation 2026-06-14
Cisco Duo Bypass Code Generation Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - Core Syslog Message Volume Drop Cisco ASA Logs T1685 Hunting ArcaneDoor, Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco ASA - AAA Policy Tampering Cisco ASA Logs T1556.004 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
Cisco Duo Policy Bypass 2FA Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco ASA - User Account Deleted From Local Database Cisco ASA Logs T1070.008 T1531 Anomaly Suspicious Cisco Adaptive Security Appliance Activity 2026-05-13
MCP Postgres Suspicious Query MCP Server T1555 Hunting Suspicious MCP Activities 2026-05-13
ESXi Shared or Stolen Root Account VMWare ESXi Syslog T1078 Anomaly Black Basta Ransomware, ESXi Post Compromise 2026-05-13
M365 Copilot Non Compliant Devices Accessing M365 Copilot M365 Copilot Graph API T1685 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
ESXi System Clock Manipulation VMWare ESXi Syslog T1070.006 TTP Black Basta Ransomware, ESXi Post Compromise 2026-05-13
M365 Copilot Information Extraction Jailbreak Attack M365 Exported eDiscovery Prompts T1685 TTP Suspicious Microsoft 365 Copilot Activities 2026-05-13
Suspicious Java Classes T1190 Anomaly Apache Struts Vulnerability 2026-05-13
Cisco AI Defense Security Alerts by Application Name Cisco AI Defense Alerts N/A Anomaly Abuse of GenAI Systems and Applications, Critical Alerts 2026-10-19
ESXi Encryption Settings Modified VMWare ESXi Syslog T1685 TTP Black Basta Ransomware, ESXi Post Compromise 2026-08-12
Ollama Excessive API Requests Ollama Server T1498 Anomaly Suspicious Ollama Activities 2026-10-09
ESXi External Root Login Activity VMWare ESXi Syslog T1078 Anomaly Black Basta Ransomware, ESXi Post Compromise 2026-05-13
Cisco Duo Policy Allow Old Java Cisco Duo Administrator T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
Cisco IOS XE Request Platform Package Describe Shell Pattern Cisco IOS Logs T1059 T1190 TTP Salt Typhoon 2026-05-20
Cisco AI Defense Allowed Sensitive Response Cisco AI Defense Alerts N/A TTP Data Protection, Abuse of GenAI Systems and Applications, Critical Alerts 2026-10-15
ESXi Bulk VM Termination VMWare ESXi Syslog T1499 T1529 T1673 TTP Black Basta Ransomware, ESXi Post Compromise 2026-09-08
Cisco AI Defense Allowed Sensitive Prompt Cisco AI Defense Alerts N/A TTP Data Protection, Abuse of GenAI Systems and Applications, Critical Alerts 2026-10-15
Cisco Duo Admin Login Unusual Browser Cisco Duo Activity T1556 TTP Cisco Duo Suspicious Activity 2026-05-13
M365 Copilot Session Origin Anomalies M365 Copilot Graph API T1078 Anomaly Suspicious Microsoft 365 Copilot Activities 2026-05-13
PingID Multiple Failed MFA Requests For User PingID T1078 T1110 T1621 TTP Compromised User Account 2026-05-13
PTC Windchill GW READY OK Probe Windchill Log4j T1059 T1190 Anomaly PTC Windchill Exploitation 2026-06-14
Circle CI Disable Security Step CircleCI T1554 Anomaly Dev Sec Ops 2026-10-01
Circle CI Disable Security Job CircleCI T1554 Anomaly Dev Sec Ops 2026-10-01
Ollama Possible Model Exfiltration Data Leakage Ollama Server T1048 Anomaly Suspicious Ollama Activities 2026-10-09
Ollama Possible RCE via Model Loading Ollama Server T1190 Anomaly Suspicious Ollama Activities 2026-10-09
Unusually Long Content-Type Length N/A Anomaly Apache Struts Vulnerability 2026-09-08
Detect malicious requests to exploit JBoss servers N/A TTP JBoss Vulnerability, SamSam Ransomware 2026-05-13
SQL Injection with Long URLs T1190 TTP GhostRedirector IIS Module and Rungan Backdoor, SQL Injection 2026-05-13
Detect attackers scanning for vulnerable JBoss servers T1082 T1133 TTP JBoss Vulnerability, SamSam Ransomware 2026-05-13
Detect S3 access from a new IP T1530 Anomaly Suspicious AWS S3 Activities 2026-05-13
Risk Rule for Dev Sec Ops by Repository T1204.003 Correlation Dev Sec Ops 2026-05-13
Steal or Forge Authentication Certificates Behavior Identified T1649 Correlation Windows Certificate Services 2026-10-02
Detect Excessive Account Lockouts From Endpoint T1078.002 Anomaly Active Directory Password Spraying 2026-05-13
Living Off The Land Detection T1059 T1105 T1133 T1190 Correlation Living Off The Land, Hellcat Ransomware 2026-05-13
Log4Shell CVE-2021-44228 Exploitation T1059 T1105 T1133 T1190 Correlation CISA AA22-320A, Log4Shell CVE-2021-44228 2026-05-13
Detect Excessive User Account Lockouts T1078.003 Anomaly Scattered Lapsus$ Hunters, Active Directory Password Spraying 2026-05-13
Cisco IOS Suspicious Privileged Account Creation Cisco IOS Logs T1078 T1136 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
Cisco Privileged Account Creation with Suspicious SSH Activity T1021.004 T1078 T1136 Correlation Cisco Secure Firewall Threat Defense Analytics, Salt Typhoon 2026-05-13
Cisco SNMP Community String Configuration Changes Cisco IOS Logs T1040 T1552 T1685 Anomaly Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
Cisco TFTP Server Configuration for Data Exfiltration Cisco IOS Logs T1005 T1567 TTP Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
SSL Certificates with Punycode T1573 Hunting OpenSSL CVE-2022-3602 2026-05-13
Internal Vulnerability Scan T1046 T1595.002 TTP Network Discovery, Scattered Lapsus$ Hunters 2026-05-13
Cisco Configuration Archive Logging Analysis Cisco IOS Logs T1098 T1505.003 T1685 Hunting Cisco Smart Install Remote Code Execution CVE-2018-0171 2026-05-13
SMB Traffic Spike T1021.002 Anomaly Emotet Malware DHS Report TA18-201A, DHS Report TA18-074A, Hidden Cobra Malware, Ransomware 2026-05-13
Detect Unauthorized Assets by MAC address N/A TTP Asset Tracking 2026-05-13
Email servers sending high volume traffic to hosts T1114.002 Anomaly HAFNIUM Group, Collection and Staging 2026-05-13
Detect New Login Attempts to Routers N/A TTP Router and Infrastructure Security, Scattered Lapsus$ Hunters 2026-05-13
Email Attachments With Lots Of Spaces T1036.008 T1566.001 Anomaly Hermetic Wiper, Emotet Malware DHS Report TA18-201A, Suspicious Emails, Data Destruction 2026-05-13
Suspicious Email Attachment Extensions T1566.001 Anomaly Hermetic Wiper, Emotet Malware DHS Report TA18-201A, Suspicious Emails, Data Destruction 2026-05-13
Ollama Abnormal Service Crash Availability Attack Ollama Server T1489 Anomaly Suspicious Ollama Activities 2026-10-09
Ollama Suspicious Prompt Injection Jailbreak Ollama Server T1059 T1190 Anomaly Suspicious Ollama Activities 2026-10-09
Monitor Email For Brand Abuse N/A TTP Suspicious Emails, Brand Monitoring, Scattered Lapsus$ Hunters 2026-05-13