GitHub Repo

Command and Control Detections

Name Data Source Technique Type Analytic Story Date
Juniper Networks Remote Code Execution Exploit Detection Suricata T1059 T1105 T1190 TTP Juniper JunOS Remote Code Execution 2026-05-13
HTTP Duplicated Header Suricata T1071.001 T1190 Anomaly HTTP Request Smuggling 2026-05-13
Unusual HTTP Request Method Zeek HTTP T1071.001 T1190 Anomaly Command And Control, HTTP Request Smuggling 2026-10-12
HTTP Rapid POST with Mixed Status Codes Nginx Access T1071.001 T1190 T1595 Anomaly HTTP Request Smuggling 2026-05-13
HTTP Possible Request Smuggling Suricata T1071.001 TTP HTTP Request Smuggling 2026-05-13
Okta Non-Standard VPN Usage Okta T1078 T1090 T1572 TTP Remote Employment Fraud, Suspicious Okta Activity 2026-05-13
Microsoft Intune Mobile Apps Azure Monitor Activity T1021.007 T1072 T1105 T1202 Hunting Azure Active Directory Account Takeover 2026-05-13
Microsoft Intune Device Health Scripts Azure Monitor Activity T1021.007 T1072 T1105 T1202 Hunting Azure Active Directory Account Takeover 2026-05-13
Windows Application Layer Protocol RMS Radmin Tool Namedpipe Sysmon EventID 17, Sysmon EventID 18 T1071 TTP Azorult 2026-05-13
Windows Suspicious QEMU Execution Sysmon EventID 1 T1001 T1036 T1204.002 T1564.006 TTP VoidLink Cloud-Native Linux Malware, Linux Living Off The Land, Linux Privilege Escalation, Linux Rootkit, Compromised Linux Host, Linux Post-Exploitation 2026-05-13
Windows Non-System Process Querying Definition Update Sysmon EventID 22 T1068 T1071.001 Anomaly BlueHammer, Windows Privilege Escalation, RedSun 2026-10-08
Windows Devtunnels Image Loaded Sysmon EventID 7 T1090 Anomaly Reverse Network Proxy 2026-05-13
Windows AI Platform DNS Query Sysmon EventID 22 T1071.004 Anomaly SesameOp, LAMEHUG, PromptFlux 2026-09-22
Cisco NVM - Webserver Download From File Sharing Website Cisco Network Visibility Module Flow Data T1105 T1190 TTP GhostRedirector IIS Module and Rungan Backdoor, Cisco Network Visibility Module Analytics 2026-09-22
Cisco NVM - Suspicious File Download via Headless Browser Cisco Network Visibility Module Flow Data T1059 T1105 TTP BlankGrabber Stealer, Cisco Network Visibility Module Analytics 2026-09-22
Windows Powershell Commands from DNS TXT Powershell Script Block Logging 4104 T1059.001 T1071.004 Anomaly Command And Control, Malicious PowerShell, Suspicious DNS Traffic 2026-07-30
Windows Remote Access Software BRC4 Loaded Dll Sysmon EventID 7 T1003 T1219 Anomaly Brute Ratel C4 2026-05-13
Windows Suspicious Defender Update Activity in INetCache Sysmon EventID 23, Sysmon EventID 11 T1068 T1105 Anomaly BlueHammer, Windows Persistence Techniques 2026-07-20
Windows App Layer Protocol Qakbot NamedPipe Sysmon EventID 17, Sysmon EventID 18 T1071 Anomaly Qakbot 2026-05-13
PowerShell Download from Code Hosting Service Powershell Script Block Logging 4104 T1059.001 T1105 Anomaly Braodo Stealer 2026-10-13
Windows File Transfer Protocol In Non-Common Process Path Sysmon EventID 3 T1071.003 Anomaly Hellcat Ransomware, AgentTesla, Snake Keylogger, Phantom Stealer 2026-06-25
Windows Level RMM PowerShell Script Installer Powershell Script Block Logging 4104 T1219 Anomaly Remote Monitoring and Management Software 2026-05-13
Download Files Using Telegram Sysmon EventID 15 T1105 TTP XMRig, Water Gamayun, Snake Keylogger, 0bj3ctivity Stealer, Braodo Stealer, Phemedrone Stealer, Crypto Stealer 2026-10-06
Windows Kerberos Coercion via DNS Windows Event Log Security 5136, Windows Event Log Security 5137, Windows Event Log Security 4662 T1071.004 T1187 T1557.001 TTP Local Privilege Escalation With KrbRelayUp, Kerberos Coercion with DNS, Suspicious DNS Traffic, Compromised Windows Host 2026-05-13
Windows Mail Protocol In Non-Common Process Path Sysmon EventID 3 T1071.003 Anomaly AgentTesla 2026-05-13
Cisco NVM - Outbound Connection to Suspicious Port Cisco Network Visibility Module Flow Data T1571 Anomaly Cisco Network Visibility Module Analytics 2026-09-22
PowerShell Script Block With URL Chain Powershell Script Block Logging 4104 T1059.001 T1105 TTP Malicious PowerShell, Hellcat Ransomware 2026-05-13
Windows Visual Basic Commandline Compiler DNSQuery Sysmon EventID 22 T1071.004 TTP Lokibot 2026-05-13
Windows DNS Query Request To TinyUrl Sysmon EventID 22 T1105 Anomaly Malicious Inno Setup Loader, Braodo Stealer 2026-10-06
Windows Short Lived DNS Record Windows Event Log Security 5136, Windows Event Log Security 5137 T1071.004 T1187 T1557.001 TTP Local Privilege Escalation With KrbRelayUp, Kerberos Coercion with DNS, Suspicious DNS Traffic, Compromised Windows Host 2026-05-13
Windows DLL Module Loaded in Temp Dir Sysmon EventID 7 T1105 Hunting Interlock Rat, Lokibot, SolarWinds WHD RCE Post Exploitation 2026-05-13
PowerShell WebRequest Using Memory Stream Powershell Script Block Logging 4104 T1027.011 T1059.001 T1105 TTP Medusa Ransomware, Malicious PowerShell, MoonPeak, PHP-CGI RCE Attack on Japanese Organizations 2026-05-13
Windows App Layer Protocol Wermgr Connect To NamedPipe Sysmon EventID 17, Sysmon EventID 18 T1071 Anomaly Windows Error Reporting Service Elevation of Privilege Vulnerability, RoguePlanet, Qakbot 2026-08-18
Windows Level RMM Watchdog Task Created Windows Event Log Security 4698 T1053 T1219 Anomaly Remote Monitoring and Management Software 2026-05-13
Windows SoftEther VPN Masquerading as Legitimate Binary Sysmon EventID 1 T1036 T1572 TTP Linux Persistence Techniques, Flax Typhoon, Linux Privilege Escalation 2026-05-13
Windows RMM Tool Execution Sysmon EventID 1 T1219 Anomaly NetSupport RMM Tool Abuse, Remote Monitoring and Management Software, Suspicious User Agents 2026-05-13
Cisco Isovalent - Curl Execution With Insecure Flags Cisco Isovalent Process Exec T1105 Anomaly Cisco Isovalent Suspicious Activity 2026-10-02
Cisco NVM - Osascript Network Connection for a Long Duration Cisco Network Visibility Module Flow Data T1059.002 T1071.001 Anomaly Command And Control, MacOS Post-Exploitation, Cisco Network Visibility Module Analytics 2026-09-22
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script Powershell Script Block Logging 4104 T1071.001 T1078 T1212 T1482 TTP Azure Active Directory Account Takeover, Azure Active Directory Persistence, Azure Active Directory Privilege Escalation 2026-10-09
Windows Abused Web Services Sysmon EventID 22 T1102 Anomaly Malicious Inno Setup Loader, BlankGrabber Stealer, CISA AA24-241A, NjRAT 2026-05-13
Zeek x509 Certificate with Punycode T1573 Hunting OpenSSL CVE-2022-3602 2026-05-13
Cisco Secure Firewall - Blacklisted SSL Certificate Fingerprint Cisco Secure Firewall Threat Defense Connection Event T1071.001 T1573.002 T1587.002 T1588.004 TTP Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco SA - Access to Anonymizer Services Cisco Secure Access DNS T1090.003 Anomaly Cisco Secure Access Analytics 2026-06-09
Cisco Secure Firewall - Repeated Malware Downloads Cisco Secure Firewall Threat Defense File Event T1027 T1105 Anomaly Cisco Secure Firewall Threat Defense Analytics, Hellcat Ransomware 2026-09-22
Windows Multi hop Proxy TOR Website Query Sysmon EventID 22 T1071.003 Anomaly Interlock Ransomware, AgentTesla 2026-05-13
Cisco Secure Firewall - High EVE Threat Confidence Cisco Secure Firewall Threat Defense Connection Event T1041 T1071.001 T1105 T1573.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Snort Rule Triggered Across Multiple Hosts Cisco Secure Firewall Threat Defense Intrusion Event T1027 T1105 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Malware File Downloaded Cisco Secure Firewall Threat Defense File Event T1105 T1203 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - Wget or Curl Download Cisco Secure Firewall Threat Defense Connection Event T1053.003 T1059 T1071.001 T1105 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Lumma Stealer Outbound Connection Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
HTTP POST Request with Encoded Payload Zeek HTTP T1071.001 T1132.001 Anomaly Command And Control, Data Exfiltration 2026-10-19
Cisco Secure Firewall - Intrusion Events by Threat Activity Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly Cisco Secure Firewall Threat Defense Analytics, ArcaneDoor 2026-09-22
Unusual SSH Client Banner Zeek SSH T1021.004 T1572 Anomaly Ingress Tool Transfer, Command And Control 2026-10-12
Cisco Secure Firewall - Lumma Stealer Download Attempt Cisco Secure Firewall Threat Defense Intrusion Event T1041 T1573.002 Anomaly Lumma Stealer, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Windows DNS Query Request by Telegram Bot API Sysmon EventID 22 T1071.004 T1102.002 Anomaly BlankGrabber Stealer, VIP Keylogger, 0bj3ctivity Stealer, Phantom Stealer, Braodo Stealer, Starland RAT Campaign, Crypto Stealer 2026-10-06
Cisco Secure Firewall - Communication Over Suspicious Ports Cisco Secure Firewall Threat Defense Connection Event T1021 T1055 T1059.001 T1105 T1219 T1571 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-10-08
Cisco Secure Firewall - High Volume of Intrusion Events Per Host Cisco Secure Firewall Threat Defense Intrusion Event T1059 T1071 T1595.002 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco Secure Firewall - Connection to File Sharing Domain Cisco Secure Firewall Threat Defense Connection Event T1071.001 T1090.002 T1105 T1567.002 T1588.002 Anomaly Cisco Secure Firewall Threat Defense Analytics, Scattered Lapsus$ Hunters 2026-10-08
Cisco Secure Firewall - File Download Over Uncommon Port Cisco Secure Firewall Threat Defense File Event T1105 T1571 Anomaly Cisco Secure Firewall Threat Defense Analytics 2026-09-22
Cisco Secure Firewall - High Priority Intrusion Classification Cisco Secure Firewall Threat Defense Intrusion Event T1003 T1071 T1078 T1190 T1203 TTP Cisco Secure Firewall Threat Defense Analytics 2026-05-13
Cisco IOS XE Tunnel Interface Configuration Cisco IOS Logs T1090 T1572 Anomaly Salt Typhoon 2026-05-20
HTTP Scripting Tool User Agent Nginx Access T1071.001 Anomaly Suspicious User Agents, HTTP Request Smuggling 2026-09-22
HTTP Request to Reserved Name on IIS Server Suricata T1071.001 T1190 TTP HTTP Request Smuggling 2026-05-13
Detect Remote Access Software Usage URL Palo Alto Network Threat T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, CISA AA24-241A 2026-10-08
Windows Protocol Tunneling with Plink Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1021.004 T1572 TTP CISA AA22-257A 2026-05-13
Detect Remote Access Software Usage Process Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1219 Anomaly GhostRedirector IIS Module and Rungan Backdoor, Scattered Lapsus$ Hunters, Ransomware, Command And Control, Cactus Ransomware, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, Gozi Malware, CISA AA24-241A, Storm-0501 Ransomware, Seashell Blizzard, Scattered Spider 2026-10-19
LOLBAS Rare Network Connection Sysmon EventID 3 T1105 T1218 T1567 Anomaly NetSupport RMM Tool Abuse, GhostRedirector IIS Module and Rungan Backdoor, Water Gamayun, Living Off The Land, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Fake CAPTCHA Campaigns, Malicious Inno Setup Loader 2026-08-24
Detect Remote Access Software Usage Registry Sysmon EventID 13 T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Cactus Ransomware, Insider Threat, Remote Monitoring and Management Software, Gozi Malware, CISA AA24-241A, Seashell Blizzard, Scattered Spider 2026-10-19
Windows Ldifde Directory Object Behavior Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1069.002 T1105 TTP Volt Typhoon 2026-10-02
LOLBAS Network Connection On Uncommon Port Sysmon EventID 3 T1105 T1218 T1567 Anomaly NetSupport RMM Tool Abuse, GhostRedirector IIS Module and Rungan Backdoor, Water Gamayun, Living Off The Land, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Fake CAPTCHA Campaigns, Malicious Inno Setup Loader 2026-08-24
Windows Process Execution From RDP Share Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1021.001 T1059 T1105 Anomaly Hidden Cobra Malware 2026-05-13
BITSAdmin Download File Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 T1197 TTP GhostRedirector IIS Module and Rungan Backdoor, Living Off The Land, Ingress Tool Transfer, BITS Jobs, Flax Typhoon, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Gozi Malware, DarkSide Ransomware, Scattered Spider 2026-10-02
Windows Curl Upload to Remote Destination Cisco Network Visibility Module Flow Data, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP PromptLock, Microsoft WSUS CVE-2025-59287, Ingress Tool Transfer, Axios Supply Chain Post Compromise, NPM Supply Chain Compromise, Cisco Network Visibility Module Analytics, Compromised Windows Host 2026-10-09
WinRAR Spawning Shell Application Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP WinRAR Spoofing Attack CVE-2023-38831, Compromised Windows Host 2026-05-13
Linux Curl Upload File Sysmon for Linux EventID 1, Cisco Isovalent Process Exec T1105 TTP Ingress Tool Transfer, Linux Living Off The Land, Data Exfiltration, NPM Supply Chain Compromise 2026-10-02
Linux Ingress Tool Transfer Hunting Sysmon for Linux EventID 1 T1105 Hunting Ingress Tool Transfer, Linux Living Off The Land, Axios Supply Chain Post Compromise, NPM Supply Chain Compromise, XorDDos 2026-10-09
Windows Proxy Via Registry Sysmon EventID 13 T1090.001 Anomaly Volt Typhoon 2026-10-02
Curl Execution with Percent Encoded URL CrowdStrike ProcessRollup2, Sysmon for Linux EventID 1, Windows Event Log Security 4688, Sysmon EventID 1 T1027 T1105 Anomaly Ingress Tool Transfer, Living Off The Land, Compromised Windows Host 2026-05-13
Windows Process Accessing IronLanguages Repository On GitHub Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1059 T1105 Anomaly Ingress Tool Transfer, Windows Post-Exploitation, Fake CAPTCHA Campaigns, Compromised Windows Host 2026-09-16
Detect Remote Access Software Usage File Sysmon EventID 11 T1219 Anomaly GhostRedirector IIS Module and Rungan Backdoor, Scattered Lapsus$ Hunters, Cactus Ransomware, Command And Control, Ransomware, Insider Threat, Interlock Ransomware, Remote Monitoring and Management Software, Gozi Malware, CISA AA24-241A, Seashell Blizzard, Scattered Spider 2026-10-19
File Download or Read to Pipe Execution CrowdStrike ProcessRollup2, Windows Event Log Security 4688, Sysmon EventID 1, Sysmon for Linux EventID 1 T1105 TTP Ingress Tool Transfer, Linux Living Off The Land, Log4Shell CVE-2021-44228, NPM Supply Chain Compromise, Compromised Windows Host 2026-09-01
Windows Ngrok Reverse Proxy Usage Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1090 T1102 T1572 Anomaly CISA AA24-241A, CISA AA22-320A, Reverse Network Proxy 2026-10-09
Windows Finger.exe Connecting to a Remote Host Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1071 TTP Living Off The Land, Command And Control, Windows Post-Exploitation, Compromised Windows Host, Fake CAPTCHA Campaigns 2026-09-16
Windows Proxy Via Netsh Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1090.001 Anomaly Volt Typhoon 2026-10-02
Windows Potential Cloudflared Network Connection Sysmon EventID 3 T1572 Hunting Reverse Network Proxy 2026-05-13
Windows File Download Via PowerShell Cisco Network Visibility Module Flow Data, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1059.001 T1105 Anomaly Microsoft WSUS CVE-2025-59287, Ingress Tool Transfer, PHP-CGI RCE Attack on Japanese Organizations, SolarWinds WHD RCE Post Exploitation, Winter Vivern, Hermetic Wiper, Tuoni, NPM Supply Chain Compromise, XWorm, IcedID, APT37 Rustonotto and FadeStealer, NetSupport RMM Tool Abuse, HAFNIUM Group, GhostRedirector IIS Module and Rungan Backdoor, Data Destruction, Malicious PowerShell, Cisco Network Visibility Module Analytics, SysAid On-Prem Software CVE-2023-47246 Vulnerability, Phemedrone Stealer, StealC Stealer 2026-10-02
Windows Outlook Macro Security Modified Sysmon EventID 13 T1008 T1137 TTP Windows Registry Abuse, NotDoor Malware 2026-05-13
Living Off The Land Detection T1059 T1105 T1133 T1190 Correlation Hellcat Ransomware, Living Off The Land 2026-05-13
Detect Certify Command Line Arguments Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 T1649 TTP Ingress Tool Transfer, Windows Certificate Services, Compromised Windows Host 2026-05-13
Windows Potential Cloudflared Tunnel Execution Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1572 Anomaly Reverse Network Proxy 2026-05-13
Windows SSH Proxy Command Sysmon EventID 1 T1059.001 T1105 T1572 Anomaly Hellcat Ransomware, ZDI-CAN-25373 Windows Shortcut Exploit Abused as Zero-Day, Living Off The Land 2026-10-09
Linux Proxy Socks Curl Sysmon for Linux EventID 1 T1090 T1095 TTP Ingress Tool Transfer, Linux Living Off The Land 2026-06-04
Windows Cabinet File Extraction Via Expand Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP NetSupport RMM Tool Abuse, APT37 Rustonotto and FadeStealer 2026-10-09
Log4Shell CVE-2021-44228 Exploitation T1059 T1105 T1133 T1190 Correlation Log4Shell CVE-2021-44228, CISA AA22-320A 2026-05-13
Windows File Download Via CertUtil Cisco Network Visibility Module Flow Data, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP Living Off The Land, Ingress Tool Transfer, Flax Typhoon, CISA AA22-277A, Forest Blizzard, ProxyNotShell, DarkSide Ransomware, Cisco Network Visibility Module Analytics, Compromised Windows Host 2026-10-09
Linux Ngrok Reverse Proxy Usage Sysmon for Linux EventID 1 T1090 T1102 T1572 Anomaly Reverse Network Proxy 2026-10-30
Socat Remote TCP Connection with Local Echo Disabled Osquery Results, Sysmon for Linux EventID 1 T1059 T1572 Anomaly MacOS Post-Exploitation 2026-08-27
Detect Remote Access Software Usage FileInfo Sysmon EventID 1 T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Cactus Ransomware, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, Gozi Malware, Seashell Blizzard, Scattered Spider 2026-10-08
Socat Network Listener Binding an Executable Osquery Results, Sysmon for Linux EventID 1 T1059 T1572 TTP MacOS Post-Exploitation 2026-08-27
Windows Remote Access Software RMS Registry Sysmon EventID 13 T1219 TTP Azorult 2026-05-13
Windows SQL Spawning CertUtil Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP Storm-2460 CLFS Zero Day Exploitation, Flax Typhoon, SQL Server Abuse 2026-05-13
Windows Credential Target Information Structure in Commandline Sysmon EventID 1 T1071.004 T1187 T1557.001 TTP Local Privilege Escalation With KrbRelayUp, Kerberos Coercion with DNS, Suspicious DNS Traffic, Compromised Windows Host 2026-05-13
Potential Telegram API Request Via CommandLine Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1041 T1102.002 Anomaly XMRig, Water Gamayun, BlankGrabber Stealer, Hellcat Ransomware, 0bj3ctivity Stealer 2026-05-13
Linux Ingress Tool Transfer with Curl Sysmon for Linux EventID 1 T1105 Anomaly Ingress Tool Transfer, Linux Living Off The Land, NPM Supply Chain Compromise, XorDDos 2026-10-09
Windows Curl Download to Suspicious Path Cisco Network Visibility Module Flow Data, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 TTP GhostRedirector IIS Module and Rungan Backdoor, Ingress Tool Transfer, China-Nexus Threat Activity, Forest Blizzard, IcedID, APT37 Rustonotto and FadeStealer, NPM Supply Chain Compromise, Cisco Network Visibility Module Analytics, Compromised Windows Host, Starland RAT Campaign, Salt Typhoon, Black Basta Ransomware 2026-10-02
Windows TOR Client Execution Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1090.003 Anomaly Command And Control, Windows Post-Exploitation, Data Protection, Compromised Windows Host, Data Exfiltration 2026-05-13
Suspicious Curl Network Connection CrowdStrike ProcessRollup2, Windows Event Log Security 4688, Sysmon EventID 1, Sysmon for Linux EventID 1 T1105 TTP GhostRedirector IIS Module and Rungan Backdoor, Ingress Tool Transfer, Linux Living Off The Land, Hellcat Ransomware, APT37 Rustonotto and FadeStealer, Silver Sparrow 2026-05-13
Windows Ingress Tool Transfer Using Explorer Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1105 Anomaly DarkCrystal RAT 2026-05-13
Windows Devtunnels Execution Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Sysmon EventID 1 T1090 Anomaly Reverse Network Proxy 2026-05-13
Windows PowGoop Beacon Decoding CrowdStrike ProcessRollup2, Sysmon EventID 1 T1001 T1059.001 TTP Compromised Windows Host 2026-05-13
TOR Traffic Cisco Secure Firewall Threat Defense Connection Event, Palo Alto Network Traffic T1090.003 TTP Prohibited Traffic Allowed or Protocol Mismatch, Ransomware, NOBELIUM Group, Command And Control, Interlock Ransomware, Cisco Secure Firewall Threat Defense Analytics 2026-05-13
HTTP Malware User Agent Suricata T1071.001 TTP Lumma Stealer, Meduza Stealer, RedLine Stealer, Lokibot, Suspicious User Agents, Crypto Stealer 2026-09-22
HTTP RMM User Agent Suricata T1071.001 T1219 Anomaly Remote Monitoring and Management Software, Suspicious User Agents 2026-09-22
SSL Certificates with Punycode T1573 Hunting OpenSSL CVE-2022-3602 2026-05-13
HTTP PUA User Agent Suricata T1071.001 Anomaly Suspicious User Agents, Local Privilege Escalation With KrbRelayUp, BlackSuit Ransomware, Cactus Ransomware 2026-09-22
Excessive DNS Failures T1071.004 Anomaly Command And Control, Suspicious DNS Traffic 2026-05-13
Cisco Secure Firewall - Remote Access Software Usage Traffic Cisco Secure Firewall Threat Defense Connection Event T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, Cisco Secure Firewall Threat Defense Analytics, Scattered Spider 2026-10-08
Detect Remote Access Software Usage DNS Sysmon EventID 22 T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, CISA AA24-241A, Scattered Spider 2026-10-08
HTTP C2 Framework User Agent Suricata T1071.001 TTP Meterpreter, BishopFox Sliver Adversary Emulation Framework, Tuoni, Cobalt Strike, Malicious PowerShell, Suspicious User Agents, Brute Ratel C4, Spearphishing Attachments 2026-09-22
Ngrok Reverse Proxy on Network Sysmon EventID 22 T1090 T1102 T1572 Anomaly CISA AA24-241A, CISA AA22-320A, Reverse Network Proxy 2026-05-13
DNS Kerberos Coercion Sysmon EventID 22, Suricata T1071.004 T1187 T1557.001 TTP Local Privilege Escalation With KrbRelayUp, Kerberos Coercion with DNS, Suspicious DNS Traffic, Compromised Windows Host 2026-09-08
Detect Remote Access Software Usage Traffic Palo Alto Network Traffic T1219 Anomaly Scattered Lapsus$ Hunters, Ransomware, Command And Control, Insider Threat, Remote Monitoring and Management Software, Interlock Ransomware, Scattered Spider 2026-10-08
Detect Outbound SMB Traffic Cisco Secure Firewall Threat Defense Connection Event, Cisco Secure Access Firewall T1071.002 TTP Hidden Cobra Malware, NOBELIUM Group, Cisco Secure Firewall Threat Defense Analytics, Cisco Secure Access Analytics, DHS Report TA18-074A 2026-05-13
Detect Large ICMP Traffic Cisco Secure Access Firewall, Palo Alto Network Traffic T1095 TTP Command And Control, Cisco Secure Access Analytics, Backdoor Pingpong, China-Nexus Threat Activity 2026-10-02