Content Release Notes

2025.10.20

Summary of Changes

Totals: 42 added / 112 modified
Intelligence: 0 added / 0 modified
Detections: 38 added / 109 modified
Threats: 0 added / 0 modified
Attack Scripts: 4 added / 2 modified
Collections: 0 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Application Whitelisting Bypass Attempt via Rundll32
• Suspicious Sudo Parameter
• Suspicious Staging of Alternate System Files
• Suspicious GCC Invocation Building Init Shared Object
• Possible CVE-2025-10035 Exploitation

Atomic Red Team

• At - Schedule a job via kubectl in a Pod
• Curl Insecure Connection from a Pod
• Create a Linux user via kubectl in a Pod
• Simulate npm package installation on a Linux system

Microsoft Sentinel

• RSA ID Plus - Locked Administrator Account Detected
• VMware ESXi - SSH Enable on ESXi Host
• S3 Object Exfiltration from Anonymous User
• EC2 Startup Shell Script Changed
• SAP ETD - Synch investigations

Sigma Community Rules

• Suspicious BitLocker Access Agent Update Utility Execution
• AWS IAM User with Console Access Login Without MFA
• BaaUpdate.exe Suspicious DLL Load
• WinRAR Creating Files in Startup Locations
• IIS WebServer Log Deletion via CommandLine Utilities

Splunk

• M365 Copilot Jailbreak Attempts
• M365 Copilot Impersonation Jailbreak Attack
• Ollama Abnormal Network Connectivity
• M365 Copilot Agentic Jailbreak Attack
• Ollama Excessive API Requests
• M365 Copilot Failed Authentication Patterns
• Ollama Possible API Endpoint Scan Reconnaissance
• M365 Copilot Application Usage Pattern Anomalies
• M365 Copilot Non Compliant Devices Accessing M365 Copilot
• Windows Change File Association Command To Notepad
• Windows Application Whitelisting Bypass Attempt via Rundll32
• Ollama Suspicious Prompt Injection Jailbreak
• Ollama Possible RCE via Model Loading
• Windows Cabinet File Extraction Via Expand
• M365 Copilot Information Extraction Jailbreak Attack
• Ollama Possible Model Exfiltration Data Leakage
• Ollama Abnormal Service Crash Availability Attack
• Web or Application Server Spawning a Shell
• Windows Symlink Evaluation Change via Fsutil
• M365 Copilot Session Origin Anomalies
• Ollama Possible Memory Exhaustion Resource Abuse
• Windows Set Network Profile Category to Private via Registry
• Windows Visual Basic Commandline Compiler DNSQuery

Content Updated

SnapAttack Subscribers (subscribers only)

• Hunt - Possibly Malicious User Agents
• Suspicious Redis Activity

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• Office Application Startup - Outlook as a C2
• Gatekeeper Bypass

Microsoft Sentinel

• TI map IP entity to AzureFirewall

Sigma Community Rules

• PUA - TruffleHog Execution
• Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
• Shai-Hulud NPM Attack GitHub Activity
• Linux Sudo Chroot Execution
• Shai-Hulud NPM Package Malicious Exfiltration via Curl
• Shai-Hulud Malicious GitHub Workflow Creation
• PUA - TruffleHog Execution - Linux
• Potential CVE-2023-23397 Exploitation Attempt - SMB
• WannaCry Ransomware Activity
• Rare Remote Thread Creation By Uncommon Source Image
• Suspicious C2 Activities
• Firewall Configuration Discovery Via Netsh.EXE
• Office Application Initiated Network Connection To Non-Local IP
• Ping Hex IP
• CurrentVersion Autorun Keys Modification
• Uncommon AppX Package Locations
• Modify System Firewall
• WinRAR Execution in Non-Standard Folder
• Suspicious Process Suspension via WERFaultSecure through EDR-Freeze
• Office Application Initiated Network Connection Over Uncommon Ports
• Suspicious Access to Sensitive File Extensions
• Suspicious Volume Shadow Copy Vssapi.dll Load
• Alternate PowerShell Hosts - PowerShell Module
• Office Autorun Keys Modification
• Suspicious Userinit Child Process
• Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
• Suspicious Access to Sensitive File Extensions - Zeek
• File With Uncommon Extension Created By An Office Application
• Potentially Suspicious Desktop Background Change Via Registry
• Account Tampering - Suspicious Failed Logon Reasons
• SMB Create Remote File Admin Share
• CurrentVersion NT Autorun Keys Modification
• Suspicious WSMAN Provider Image Loads
• Startup Folder File Write
• Program Executed Using Proxy/Local Command Via SSH.EXE
• System File Execution Location Anomaly
• Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
• Windows Binaries Write Suspicious Extensions
• Files With System Process Name In Unsuspected Locations
• Process Creation Using Sysnative Folder
• Potential JLI.dll Side-Loading
• File And SubFolder Enumeration Via Dir Command
• PowerShell Module File Created By Non-PowerShell Process
• Potential Goopdate.DLL Sideloading
• Potential Persistence Via Visual Studio Tools for Office
• Filter Driver Unloaded Via Fltmc.EXE
• Potential PendingFileRenameOperations Tampering
• Suspicious Copy From or To System Directory
• Use Short Name Path in Command Line
• Potential Antivirus Software DLL Sideloading
• Direct Autorun Keys Modification
• Potential Suspicious Browser Launch From Document Reader Process
• Removal of Potential COM Hijacking Registry Keys
• Recon Command Output Piped To Findstr.EXE
• Potential Persistence Via Netsh Helper DLL - Registry
• Change PowerShell Policies to an Insecure Level
• Verclsid.exe Runs COM Object
• Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
• Amsi.DLL Loaded Via LOLBIN Process
• Process Proxy Execution Via Squirrel.EXE
• HackTool - LaZagne Execution
• Service Binary in Suspicious Folder
• PowerShell Core DLL Loaded By Non PowerShell Process
• Registry Persistence via Service in Safe Mode
• Firewall Rule Deleted Via Netsh.EXE
• Potentially Suspicious Windows App Activity
• File Download with Headless Browser
• Wow6432Node CurrentVersion Autorun Keys Modification
• New RUN Key Pointing to Suspicious Folder
• Potential DLL Sideloading Of DBGHELP.DLL
• Potential AutoLogger Sessions Tampering
• Uncommon New Firewall Rule Added In Windows Firewall Exception List
• Powershell Create Scheduled Task
• Removal Of AMSI Provider Registry Keys
• Internet Explorer DisableFirstRunCustomize Enabled
• Potential Privileged System Service Operation - SeLoadDriverPrivilege
• Unsigned DLL Loaded by Windows Utility
• Suspicious Eventlog Clear
• Python Inline Command Execution
• Alternate PowerShell Hosts Pipe
• PSScriptPolicyTest Creation By Uncommon Process
• Delete Defender Scan ShellEx Context Menu Registry Key
• Potential DLL Sideloading Of DBGCORE.DLL
• New Kernel Driver Via SC.EXE
• PowerShell Deleted Mounted Share
• Suspicious Msiexec Quiet Install From Remote Location
• Browser Execution In Headless Mode
• IIS WebServer Access Logs Deleted

Splunk

• Linux Java Spawning Shell
• Common Ransomware Extensions
• Windows Renamed Powershell Execution
• Attempt To Add Certificate To Untrusted Store
• Windows Java Spawning Shells
• Windows AutoIt3 Execution
• Windows Information Discovery Fsutil
• USN Journal Deletion
• Add or Set Windows Defender Exclusion
• Windows Curl Download to Suspicious Path
• Windows Remote Management Execute Shell
• Windows Certutil Root Certificate Addition
• Windows Scheduled Task Created Via XML
• Windows Archived Collected Data In TEMP Folder
• Windows Rundll32 Apply User Settings Changes
• WinEvent Scheduled Task Created Within Public Path
• Windows AD Self DACL Assignment
• Windows Executable in Loaded Modules

2025.10.06

Summary of Changes

Totals: 141 added / 67 modified
Intelligence: 0 added / 0 modified
Detections: 134 added / 65 modified
Threats: 0 added / 0 modified
Attack Scripts: 7 added / 1 modified
Collections: 0 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Set Private Network Profile via Registry
• Windows AI Platform DNS Query

Atomic Red Team

• Disable ASLR Via sysctl parameters - Linux
• Windows - Display a simulated ransom note via Notepad (non-destructive)
• Abuse of linux magic system request key for Send a SIGTERM to all processes
• Freeze PPL-protected process with EDR-Freeze
• Identifying Network Shares - Linux
• Replace AtBroker.exe (App Switcher binary) with cmd.exe
• Expand CAB with expand.exe

Chronicle Detection Rules

• Ttp Windows Webserver Process Potential Webshell Execution

Microsoft Sentinel

• BloodHound Attack Path Finding - Non-Tier Zero Entra User Synced to Tier Zero AD User
• BloodHound Attack Path Finding - Owner Role on Tier Zero Resource
• BloodHound Attack Path Finding - Large Default Groups With Resource-Based Constrained Delegation Privileges
• BloodHound Attack Path Finding - Large Default Groups in SQL Admins Groups
• BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained Delegation
• BloodHound Attack Path Finding - Large Default Groups With WriteServicePrincipalName Privileges
• BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero App Roles
• BloodHound Attack Path Finding - Large Default Groups in PS Remote Users Groups
• BloodHound Attack Path Finding - Limited Ownership Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups With Add Member Privileges
• BloodHound Attack Path Finding - Large Default Groups With WriteDacl Privilege
• BloodHound Attack Path Finding - Legacy SID History on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups With ForceChangePassword Privileges
• BloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAP Attack
• BloodHound Attack Path Finding - App Admin Control of Tier Zero Principal
• BloodHound Attack Path Finding - Website Contributor Role on Tier Zero Resource
• BloodHound Attack Path Finding - Add Resource-Based Constrained Delegation Privileges on Tier Zero Computers
• BloodHound Attack Path Finding - Key Vault Contributor Role on Tier Zero Resource
• BloodHound Attack Path Finding - AKS Contributor Role on Tier Zero Managed Cluster
• BloodHound Attack Path Finding - WriteGpLink Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero Entra ID Role
• BloodHound Attack Path Finding - Non-Tier Zero Computer Hosting EnterpriseCA Trusted for NT Authentication
• BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups
• BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System
• BloodHound Attack Path Finding - Avere Contributor Role on Tier Zero Virtual Machine
• BloodHound Attack Path Finding - Large Default Groups With WriteOwnerLimitedRights Privileges
• BloodHound Attack Path Finding - Write Account Restrictions Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Read GMSA Password Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Command Execution on Tier Zero Virtual Machine
• BloodHound Attack Path Finding - Large Default Groups With Add Self Privileges
• BloodHound Attack Path Finding - Ownership of Tier Zero Principal
• BloodHound Attack Path Finding - Large Default Groups With Ownership Privileges
• BloodHound Attack Path Finding - Kerberos Delegation on Tier Zero Objects
• BloodHound Attack Path Finding - Constrained Delegation on Tier Zero Computers
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC3 Privileges
• BloodHound Attack Path Finding - Tier Zero Service Principal Control via MS Graph App Role
• BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to ADCS (ESC8) Attack
• BloodHound Attack Path Finding - Large Default Groups With WriteAccountRestrictions Privileges
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario A Privileges
• BloodHound Attack Path Finding - Contributor Role on Tier Zero Automation Account
• BloodHound Attack Path Finding - PS Remote Users on Tier Zero Computers
• BloodHound Attack Path Finding - ReadLapsPassword Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Tier Zero Group Control via MS Graph App Role
• BloodHound Attack Path Finding - Large Default Groups With GenericAll Privileges
• BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC13 Privileges Against Tier Zero Group
• BloodHound Attack Path Finding - Logic App Contributor Role on Tier Zero Logic App
• BloodHound Attack Path Finding - RDP Users on Tier Zero Computers
• BloodHound Attack Path Finding - AddSelf Privilege on Tier Zero Security Groups
• BloodHound Attack Path Finding - Add Secret to Tier Zero Principal
• BloodHound Attack Path Finding - AddOwner Role on Tier Zero Resource
• BloodHound Attack Path Finding - GenericWrite Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups With WriteGpLink Privilege
• BloodHound Attack Path Finding - Large Default Group With SyncLapsPassword Privileges
• BloodHound Attack Path Finding - SQL Admin Users on Tier Zero Computers
• BloodHound Attack Path Finding - AllExtended Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Kerberoastable User Accounts
• BloodHound Attack Path Finding - Add Member Privileges on Tier Zero Security Groups
• BloodHound Attack Path Finding - Logons From Tier Zero Users
• BloodHound Attack Path Finding - SyncLapsPassword Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Get Secrets on Tier Zero Key Vault
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario B Privileges
• BloodHound Attack Path Finding - GenericAll Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Computers Vulnerable to Coercion-Based NTLM Relay to SMB Attack
• BloodHound Attack Path Finding - Get Certifcates on Tier Zero Key Vault
• BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC1 Privileges
• BloodHound Attack Path Finding - Get Keys on Tier Zero Key Vault
• BloodHound Attack Path Finding - Large Default Groups With Read GMSA Password Privileges
• BloodHound Attack Path Finding - WriteDacl Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups With Limited Ownership Privileges
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario A Privileges
• BloodHound Attack Path Finding - Large Default Groups With WriteOwner Privileges
• BloodHound Attack Path Finding - Large Default Groups With Read LAPS Password Privileges
• BloodHound Attack Path Finding - Add Owner to Tier Zero Object via MS Graph App Role
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC4 Privileges
• BloodHound Attack Path Finding - Add Key Credential Link Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups in Local Administrator Groups
• BloodHound Attack Path Finding - User Access Admin Role on Tier Zero Resource
• BloodHound Attack Path Finding - Non-Tier Zero AD User Synced to Tier Zero Entra User
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario B Privileges
• BloodHound Attack Path Finding - Large Default Groups With RDP Access
• BloodHound Attack Path Finding - Large Default Groups With All Extended Privileges
• BloodHound Attack Path Finding - Tier Zero SMSA Installed on Non-Tier Zero Computer
• BloodHound Attack Path Finding - Contributor Role on Tier Zero Resource
• BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC10 Scenario B Privileges
• BloodHound Attack Path Finding - Large Default Groups With GenericWrite Privileges
• BloodHound Attack Path Finding - Reset a Tier Zero User's Password
• BloodHound Attack Path Finding - AS-REP Roastable User Accounts
• BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC10 Scenario A Privileges
• BloodHound Attack Path Finding - Non Tier Zero Resource Assigned to Tier Zero Service Principal
• BloodHound Attack Path Finding - WriteOwner Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Cloud App Admin Over Tier Zero Principal
• BloodHound Attack Path Finding - DCOM Users on Tier Zero Computers
• BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAPS Attack
• BloodHound Attack Path Finding - ForceChangePassword Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - VM Contributor Role on Tier Zero System
• BloodHound Attack Path Finding - Ownership Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Large Default Groups With Add Key Credential Link Privileges
• BloodHound Attack Path Finding - Admins on Tier Zero Computers
• BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier Zero Objects
• BloodHound Attack Path Finding - Add Members to Tier Zero Group
• BloodHound Attack Path Finding - Non-Tier Zero Principals With DCSync Privileges

Sigma Community Rules

• Scheduled Task Creation with Curl and PowerShell Execution Combo
• Scheduled Task Creation Masquerading as System Processes
• Potentially Suspicious Child Processes Spawned by ConHost
• MMC Executing Files with Reversed Extensions Using RTLO Abuse
• MMC Loading Script Engines DLLs
• Security Event Logging Disabled via MiniNt Registry Key - Registry Set
• Security Event Logging Disabled via MiniNt Registry Key - Process
• Potentially Suspicious Inline JavaScript Execution via NodeJS Binary
• Suspicious Child Process of SAP NetWeaver - Linux
• Potential SAP NetWeaver Webshell Creation
• Potential SAP NetWeaver Webshell Creation - Linux
• NodeJS Execution of JavaScript File
• Potential Hello-World Scraper Botnet Activity
• MacOS FileGrabber Infostealer
• Suspicious Uninstall of Windows Defender Feature via PowerShell
• Suspicious Child Process of SAP NetWeaver
• Suspicious Process Suspension via WERFaultSecure through EDR-Freeze
• WDAC Policy File Creation In CodeIntegrity Folder
• Low Reputation Effective Top-Level Domain (eTLD)
• FunkLocker Ransomware File Creation
• Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
• Potential PowerShell Console History Access Attempt via History File
• Suspicious Creation of .library-ms File — Potential CVE-2025-24054 Exploit
• Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
• Suspicious Velociraptor Child Process
• Potential ClickFix Execution Pattern - Registry
• Registry Manipulation via WMI Stdregprov

Splunk

• Cisco ASA - Logging Disabled via CLI
• Cisco ASA - Core Syslog Message Volume Drop

Content Updated

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• AWS CloudWatch Log Stream Deletes

Microsoft Sentinel

• Detect port misuse by anomaly based detection (ASIM Network Session schema)
• Anomaly found in Network Session Traffic (ASIM Network Session schema)
• GSA - Detect Abnormal Deny Rate for Source to Destination IP
• GSA - Detect Protocol Changes for Destination Ports
• Snowflake - Possible privileges discovery activity
• Snowflake - Multiple login failures from single IP
• Snowflake - Abnormal query process time
• Snowflake - Unusual query
• Snowflake - Possible data destraction
• Snowflake - User granted admin privileges
• Snowflake - Multiple failed queries
• Snowflake - Possible discovery activity
• Snowflake - Multiple login failures by user
• Snowflake - Query on sensitive or restricted table
• Malware attachment delivered
• Malware Link Clicked
• High Number of Urgent Vulnerabilities Detected
• New High Severity Vulnerability Detected Across Multiple Hosts

Sigma Community Rules

• Hacktool Ruler
• Potential File Extension Spoofing Using Right-to-Left Override
• Potential Defense Evasion Via Right-to-Left Override
• Uncommon Child Process Of Conhost.EXE
• Setup16.EXE Execution With Custom .Lst File
• HackTool - LaZagne Execution
• UNC4841 - Barracuda ESG Exploitation Indicators
• Potentially Suspicious Azure Front Door Connection
• Query Tor Onion Address - DNS Client
• Suspicious Get Local Groups Information - PowerShell
• Python Image Load By Non-Python Process
• DNS Query Tor .Onion Address - Sysmon
• HackTool - CoercedPotato Execution
• Disable Security Events Logging Adding Reg Key MiniNt
• DNS TOR Proxies
• Suspicious Get Local Groups Information
• Potential Python DLL SideLoading
• Suspicious ShellExec_RunDLL Call Via Ordinal
• BITS Transfer Job Download From File Sharing Domains
• Certificate Use With No Strong Mapping
• Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
• Suspicious File Download From File Sharing Websites - File Stream
• New Service Creation Using Sc.EXE
• Regsvr32 DLL Execution With Suspicious File Extension
• Potential Persistence Via Notepad++ Plugins
• ETW Logging/Processing Option Disabled On IIS Server
• RestrictedAdminMode Registry Value Tampering - ProcCreation
• Previously Installed IIS Module Was Removed
• Suspicious File Download From File Sharing Domain Via Curl.EXE
• Potential PsExec Remote Execution
• Command Executed Via Run Dialog Box - Registry
• HTTP Logging Disabled On IIS Server
• KDC RC4-HMAC Downgrade CVE-2022-37966
• Suspicious Windows Service Tampering
• New Module Module Added To IIS Server
• Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
• Visual Studio Code Tunnel Execution
• Renamed Visual Studio Code Tunnel Execution
• Unusual File Download From File Sharing Websites - File Stream
• Suspicious File Download From File Sharing Domain Via Wget.EXE
• Potentially Suspicious Execution From Tmp Folder
• Access To Browser Credential Files By Uncommon Applications - Security
• No Suitable Encryption Key Found For Generating Kerberos Ticket

Splunk

• Azure AD Multi-Source Failed Authentications Spike
• Internal Vertical Port Scan
• Windows Driver Load Non-Standard Path
• Cisco Secure Firewall - Intrusion Events by Threat Activity

2025.09.22

Summary of Changes

Totals: 202 added / 19 modified
Intelligence: 0 added / 0 modified
Detections: 197 added / 18 modified
Threats: 4 added / 0 modified
Attack Scripts: 0 added / 0 modified
Collections: 1 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Linux EFI Bootloader Created
• Linux EFI Bootloader File Deletion
• Possible Bootloader Modifications
• CVE-2024-7344 - Linux Bootloader Modifications
• Possible Bootloader Modification
• Suspicious File in EFI Volume
• Possible Bootkit Manipulation
• CVE-2024-7344
• Outlook Dialogs Disabled from Unusual Process
• NotDoor Malware
• HTTP Request Smuggling
• Hunt - Possibly Malicious User Agents
• Rapid POST with Mixed Response
• HTTP Request Smuggling
• Duplicated HTTP Headers
• Unusual HTTP Method
• Possible Request Smuggling with Zero Content-Length
• Possible CL-TE or TE-CL Request Smuggling
• AutomaticDestinations File Deletion
• RDP Server Registry Deletion
• RDP Client Launched with Admin Session
• RDP Cache File Deletion
• RDP Bitmap Cache File Creation

Atomic Red Team

• CVE-2024-7344 - Linux Bootloader Modifications

Microsoft Sentinel

• Lumen TI IPAddress in SecurityEvents
• Lumen TI IPAddress in OfficeActivity
• Lumen TI IPAddress in DeviceEvents
• Lumen TI domain in DnsEvents
• Lumen TI IPAddress indicator in CommonSecurityLog
• Lumen TI IPAddress in SigninLogs
• Lumen TI IPAddress in WindowsEvents
• Lumen TI IPAddress in IdentityLogonEvents
• Lumen TI IPAddress in CommonSecurityLog
• Contrast ADR - Security Incident Alert
• Contrast ADR - EDR Alert Correlation
• Contrast ADR - Exploited Attack in Production
• Contrast ADR - Exploited Attack Event
• Contrast ADR - WAF Alert Correlation
• Contrast ADR - DLP SQL Injection Correlation
• Backup Repository Deleted
• Failover Plan Failed
• Configuration Backup Job Settings Updated
• Failover Plan Started
• Objects Added to Malware Detection Exclusions
• Protection Group Deleted
• Objects for Protection Group Deleted
• Configuration Backup Failed
• WAN Accelerator Deleted
• Recovery Token Deleted
• Tape Server Deleted
• Failover Plan Stopped
• Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
• Storage Deleted
• Archive Repository Deleted
• Global Network Traffic Rules Deleted
• Storage Settings Updated
• Adding User or Group Failed
• External Repository Settings Updated
• Veeam ONE VM with No Replica (Hyper-V)
• Subtenant Deleted
• Veeam ONE Possible Ransomware Activity (vSphere)
• Tape Erase Job Started
• Protection Group Settings Updated
• SureBackup Job Failed
• Credential Record Deleted
• Malware Detection Session Finished
• Host Deleted
• Veeam ONE Application with No Recent Data Backup Sessions
• License Limit Exceeded
• KMS Server Settings Updated
• Veeam ONE Backup Server Security and Compliance State
• Malware Event Detected
• Tape Media Vault Deleted
• User or Group Added
• Cloud Gateway Deleted
• Veeam ONE VM with No Replica
• Cloud Gateway Pool Settings Updated
• Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)
• Virtual Lab Settings Updated
• License Grace Period Started
• Service Provider Updated
• Failover Plan Settings Updated
• File Server Settings Updated
• Object Storage Settings Updated
• Multi-Factor Authentication for User Disabled
• Tenant Replica Started
• Veeam ONE Malware Detection Change Tracking
• Global VM Exclusions Added
• Veeam ONE Unusual Job Duration
• Encryption Password Deleted
• Malware Detection Settings Updated
• Virtual Lab Deleted
• Coveware Security Finding Detected
• User or Group Deleted
• Multi-Factor Authentication Disabled
• Malware Activity Detected
• Job Deleted
• Four-Eyes Authorization Request Created
• Scale-Out Backup Repository Deleted
• Four-Eyes Authorization Disabled
• Objects for Job Deleted
• Multi-Factor Authentication User Locked
• License Support Expired
• License Removed
• Four-Eyes Authorization Request Rejected
• Tenant Password Changed
• Service Provider Deleted
• File Server Deleted
• License Support Expiring
• Invalid Code for Multi-Factor Authentication Entered
• Backup Proxy Deleted
• Failover Plan Deleted
• Global VM Exclusions Deleted
• Multi-Factor Authentication Token Revoked
• Hypervisor Host Deleted
• Object Storage Deleted
• Attempt to Update Security Object Failed
• Tenant Quota Deleted
• Veeam ONE Job Disabled
• SSH Credentials Changed
• Restore Point Marked as Clean
• Job No Longer Used as Second Destination
• NDMP Server Deleted
• Object Marked as Clean
• File Share Deleted
• KMS Key Rotation Job Finished
• Veeam ONE Computer with No Backup
• Tape Library Deleted
• Four-Eyes Authorization Request Expired
• Veeam ONE VM with No Backup
• Backup Repository Settings Updated
• External Repository Deleted
• Application Group Settings Updated
• KMS Server Deleted
• Veeam ONE Suspicious Incremental Backup Size
• Scale-Out Backup Repository Settings Updated
• Encryption Password Added
• Best Practice Compliance Check Not Passed
• Encryption Password Changed
• General Settings Updated
• Detaching Backups Started
• Veeam ONE Immutability State
• Archive Repository Settings Updated
• License Expiring
• Host Settings Updated
• Hypervisor Host Settings Updated
• Objects Deleted from Malware Detection Exclusions
• Configuration Backup Job Failed
• Global VM Exclusions Changed
• Tape Media Pool Deleted
• Cloud Replica Permanent Failover Performed by Tenant
• Tenant State Changed
• Tape Medium Deleted
• License Expired
• Cloud Gateway Pool Deleted
• Credential Record Updated
• Application Group Deleted
• Attempt to Delete Backup Failed
• Veeam ONE Possible Ransomware Activity (Hyper-V)
• Preferred Networks Deleted
• Subtenant Updated
• Objects for Protection Group Changed
• Tenant Quota Changed
• Restore Point Marked as Infected
• Veeam ONE VM with No Backup (Hyper-V)
• Cloud Gateway Settings Updated
• Malware Detection Exclusions List Updated
• WAN Accelerator Settings Updated
• Veeam ONE Backup Copy RPO
• Tenant Replica Stopped
• Veeam ONE Immutability Change Tracking
• Connection to Backup Repository Lost
• AWS Security Hub - Detect IAM Policies allowing full administrative privileges
• AWS Security Hub - Detect IAM root user Access Key existence
• AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
• AWS Security Hub - Detect SQS Queue policy allowing public access
• AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
• AWS Security Hub - Detect SSM documents public sharing enabled
• AWS Security Hub - CloudTrail trails without log file validation
• AWS Security Hub - IAM users with console password and no MFA
• AWS Security Hub - Detect SQS Queue lacking encryption at rest
• AWS Security Hub - EC2 instances with public IPv4 address
• AWS Security Hub - Detect root user lacking MFA

Splunk

• Windows Outlook Dialogs Disabled from Unusual Process
• Windows Outlook LoadMacroProviderOnBoot Persistence
• Windows Outlook Macro Created by Suspicious Process
• Windows Outlook Macro Security Modified
• Windows Wmic Network Discovery
• Windows Wmic DiskDrive Discovery
• Windows Set Private Network Profile via Registry
• Windows Wmic Systeminfo Discovery
• Windows Net System Service Discovery
• Windows File Collection Via Copy Utilities
• Windows Certutil Root Certificate Addition
• Windows Wmic Memory Chip Discovery
• Windows Wmic CPU Discovery
• Windows AI Platform DNS Query
• Linux Magic SysRq Key Abuse
• Windows SpeechRuntime Suspicious Child Process
• Windows SpeechRuntime COM Hijacking DLL Load
• Windows Excel ActiveMicrosoftApp Child Process
• Windows DLL Module Loaded in Temp Dir

Content Updated

SnapAttack Subscribers (subscribers only)

• EFI Volume Mounted

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Microsoft Sentinel

• GSA - Detect Protocol Changes for Destination Ports
• Commvault Cloud Alert

Splunk

• Linux Auditd Service Started
• Windows InstallUtil URL in Command Line
• Windows MSIExec Remote Download
• Cisco NVM - Suspicious File Download via Headless Browser
• Cisco NVM - Outbound Connection to Suspicious Port
• WMIC XSL Execution via URL
• Detect RClone Command-Line Usage
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Windows Curl Download to Suspicious Path
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Windows InstallUtil Remote Network Connection
• Cisco NVM - Suspicious Network Connection to IP Lookup Service API
• Cisco NVM - Curl Execution With Insecure Flags
• Cisco NVM - Non-Network Binary Making Network Connection
• Cisco Smart Install Oversized Packet Detection

2025.09.08

Summary of Changes

Totals: 6 added / 281 modified
Intelligence: 0 added / 0 modified
Detections: 5 added / 268 modified
Threats: 0 added / 1 modified
Attack Scripts: 1 added / 10 modified
Collections: 0 added / 2 modified

Content Added

SnapAttack Subscribers (subscribers only)

• PowerShell Script From WindowsApps Directory
• PowerShell MSIX Package Installation
• Default RDP File Unhidden
• Default RDP File Deleted
• Default RDP File Created

Atomic Red Team

• abuse of linux magic system request key for reboot

Content Updated

SnapAttack Subscribers (subscribers only)

• NotDoor Malware
• HTTP Request Smuggling
• Hunt - Possibly Malicious User Agents
• Possible CL-TE or TE-CL Request Smuggling
• Rapid POST with Mixed Response
• HTTP Request Smuggling
• Duplicated HTTP Headers
• Unusual HTTP Method
• Possible Request Smuggling with Zero Content-Length
• AutomaticDestinations File Deletion
• RDP Server Registry Deletion
• RDP Client Launched with Admin Session
• RDP Cache File Deletion
• RDP Bitmap Cache File Creation

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• WinPwn - winPEAS
• WinPwn - itm4nprivesc
• WinPwn - PowerSharpPack - Seatbelt
• WinPwn - Powersploits privesc checks
• WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors
• WinPwn - General privesc checks
• WinPwn - PowerSharpPack - Watson searching for missing windows patches
• WinPwn - GeneralRecon
• WinPwn - Morerecon
• WinPwn - RBCD-Check

LOLDrivers

• Vulnerable Driver Load Despite HVCI (sha1)
• Malicious Driver Load Despite HVCI (md5)
• Vulnerable Driver Load By Name
• Malicious Driver Load (md5)
• Malicious Driver Load By Name
• Vulnerable Driver Load Despite HVCI (sha256)
• Malicious Driver Load Despite HVCI (sha256)
• Malicious Driver Load Despite HVCI (sha1)
• Malicious Driver Load (sha256)
• Malicious Driver Load (sha1)
• Vulnerable Driver Load (sha1)
• Vulnerable Driver Load Despite HVCI (md5)
• Vulnerable Driver Load (md5)
• Vulnerable Driver Load (sha256)

Microsoft Sentinel

• Backup Repository Deleted
• Failover Plan Failed
• Configuration Backup Job Settings Updated
• Failover Plan Started
• Objects Added to Malware Detection Exclusions
• Protection Group Deleted
• Objects for Protection Group Deleted
• Configuration Backup Failed
• WAN Accelerator Deleted
• Recovery Token Deleted
• Tape Server Deleted
• Failover Plan Stopped
• Veeam ONE Unusual Job Duration (Veeam Backup for Microsoft 365)
• Storage Deleted
• Archive Repository Deleted
• Global Network Traffic Rules Deleted
• Storage Settings Updated
• Adding User or Group Failed
• External Repository Settings Updated
• Veeam ONE VM with No Replica (Hyper-V)
• Subtenant Deleted
• Veeam ONE Possible Ransomware Activity (vSphere)
• Tape Erase Job Started
• Protection Group Settings Updated
• SureBackup Job Failed
• Credential Record Deleted
• Malware Detection Session Finished
• Host Deleted
• Veeam ONE Application with No Recent Data Backup Sessions
• License Limit Exceeded
• KMS Server Settings Updated
• Veeam ONE Backup Server Security and Compliance State
• Malware Event Detected
• Tape Media Vault Deleted
• User or Group Added
• Cloud Gateway Deleted
• Veeam ONE VM with No Replica
• Cloud Gateway Pool Settings Updated
• Veeam ONE Job Disabled (Veeam Backup for Microsoft 365)
• Virtual Lab Settings Updated
• License Grace Period Started
• Service Provider Updated
• Failover Plan Settings Updated
• File Server Settings Updated
• Object Storage Settings Updated
• Multi-Factor Authentication for User Disabled
• Tenant Replica Started
• Veeam ONE Malware Detection Change Tracking
• Global VM Exclusions Added
• Veeam ONE Unusual Job Duration
• Encryption Password Deleted
• Malware Detection Settings Updated
• Virtual Lab Deleted
• Coveware Security Finding Detected
• User or Group Deleted
• Multi-Factor Authentication Disabled
• Malware Activity Detected
• Job Deleted
• Four-Eyes Authorization Request Created
• Scale-Out Backup Repository Deleted
• Four-Eyes Authorization Disabled
• Objects for Job Deleted
• Multi-Factor Authentication User Locked
• License Support Expired
• License Removed
• Four-Eyes Authorization Request Rejected
• Tenant Password Changed
• Service Provider Deleted
• File Server Deleted
• License Support Expiring
• Invalid Code for Multi-Factor Authentication Entered
• Backup Proxy Deleted
• Failover Plan Deleted
• Global VM Exclusions Deleted
• Multi-Factor Authentication Token Revoked
• Hypervisor Host Deleted
• Object Storage Deleted
• Attempt to Update Security Object Failed
• Tenant Quota Deleted
• Veeam ONE Job Disabled
• SSH Credentials Changed
• Restore Point Marked as Clean
• Job No Longer Used as Second Destination
• NDMP Server Deleted
• Object Marked as Clean
• File Share Deleted
• KMS Key Rotation Job Finished
• Veeam ONE Computer with No Backup
• Tape Library Deleted
• Four-Eyes Authorization Request Expired
• Veeam ONE VM with No Backup
• Backup Repository Settings Updated
• External Repository Deleted
• Application Group Settings Updated
• KMS Server Deleted
• Veeam ONE Suspicious Incremental Backup Size
• Scale-Out Backup Repository Settings Updated
• Encryption Password Added
• Best Practice Compliance Check Not Passed
• Encryption Password Changed
• General Settings Updated
• Detaching Backups Started
• Veeam ONE Immutability State
• Archive Repository Settings Updated
• License Expiring
• Host Settings Updated
• Hypervisor Host Settings Updated
• Objects Deleted from Malware Detection Exclusions
• Configuration Backup Job Failed
• Global VM Exclusions Changed
• Tape Media Pool Deleted
• Cloud Replica Permanent Failover Performed by Tenant
• Tenant State Changed
• Tape Medium Deleted
• License Expired
• Cloud Gateway Pool Deleted
• Credential Record Updated
• Application Group Deleted
• Attempt to Delete Backup Failed
• Veeam ONE Possible Ransomware Activity (Hyper-V)
• Preferred Networks Deleted
• Subtenant Updated
• Objects for Protection Group Changed
• Tenant Quota Changed
• Restore Point Marked as Infected
• Veeam ONE VM with No Backup (Hyper-V)
• Cloud Gateway Settings Updated
• Malware Detection Exclusions List Updated
• WAN Accelerator Settings Updated
• Veeam ONE Backup Copy RPO
• Tenant Replica Stopped
• Veeam ONE Immutability Change Tracking
• Connection to Backup Repository Lost
• AWS Security Hub - Detect IAM Policies allowing full administrative privileges
• AWS Security Hub - Detect IAM root user Access Key existence
• AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
• AWS Security Hub - Detect SQS Queue policy allowing public access
• AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
• AWS Security Hub - Detect SSM documents public sharing enabled
• AWS Security Hub - CloudTrail trails without log file validation
• AWS Security Hub - IAM users with console password and no MFA
• AWS Security Hub - Detect SQS Queue lacking encryption at rest
• AWS Security Hub - EC2 instances with public IPv4 address
• AWS Security Hub - Detect root user lacking MFA
• Abnormal Port to Protocol

Sigma Community Rules

• IIS Native-Code Module Command Line Installation
• Windows Recovery Environment Disabled Via Reagentc
• Potential Execution of Sysinternals Tools
• Suspicious Msiexec Quiet Install From Remote Location
• Potentially Suspicious Ping/Copy Command Combination
• Uninstall Sysinternals Sysmon
• Potential Arbitrary Command Execution Using Msdt.EXE
• Diskshadow Script Mode Execution
• Diskshadow Script Mode - Uncommon Script Extension Execution
• New Root Certificate Installed Via Certutil.EXE
• File And SubFolder Enumeration Via Dir Command
• File In Suspicious Location Encoded To Base64 Via Certutil.EXE
• Explorer Process Tree Break
• Esentutl Steals Browser Information
• Forfiles Command Execution
• Msiexec Quiet Installation
• Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
• Console CodePage Lookup Via CHCP
• Capture Credentials with Rpcping.exe
• Suspicious Msiexec Execute Arbitrary DLL
• Suspicious File Encoded To Base64 Via Certutil.EXE
• PsExec/PAExec Escalation to LOCAL SYSTEM
• New Generic Credentials Added Via Cmdkey.EXE
• LSASS Process Reconnaissance Via Findstr.EXE
• Capabilities Discovery - Linux
• Copying Sensitive Files with Credential Data
• Potential Privilege Escalation To LOCAL SYSTEM
• Suspicious DLL Loaded via CertOC.EXE
• Process Terminated Via Taskkill
• Imports Registry Key From an ADS
• File Deletion Via Del
• Loaded Module Enumeration Via Tasklist.EXE
• Remote File Download Via Findstr.EXE
• Suspicious Use of PsLogList
• Curl Download And Execute Combination
• Potential Regsvr32 Commandline Flag Anomaly
• Suspicious Service Installation Script
• Enumerate All Information With Whoami.EXE
• File Decoded From Base64/Hex Via Certutil.EXE
• Suspicious Ping/Del Command Combination
• Suspicious Cabinet File Execution Via Msdt.EXE
• Suspicious Response File Execution Via Odbcconf.EXE
• DLL Loaded via CertOC.EXE
• Changing Existing Service ImagePath Value Via Reg.EXE
• Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
• File Encoded To Base64 Via Certutil.EXE
• Raspberry Robin Subsequent Execution of Commands
• Port Forwarding Activity Via SSH.EXE
• Raspberry Robin Initial Execution From External Drive
• Diskshadow Script Mode - Execution From Potential Suspicious Location
• Exports Critical Registry Keys To a File
• Insensitive Subfolder Search Via Findstr.EXE
• Wlrmdr.EXE Uncommon Argument Or Child Process
• DllUnregisterServer Function Call Via Msiexec.EXE
• Process Memory Dump via RdrLeakDiag.EXE
• Potentially Suspicious Cabinet File Expansion
• System Information Discovery via Registry Queries
• Kernel Memory Dump Via LiveKD
• New Remote Desktop Connection Initiated Via Mstsc.EXE
• Qakbot Regsvr32 Calc Pattern
• Renamed ProcDump Execution
• XSL Script Execution Via WMIC.EXE
• Exports Registry Key To a File
• Rebuild Performance Counter Values Via Lodctr.EXE
• Certificate Exported Via Certutil.EXE
• Lolbin Unregmp2.exe Use As Proxy
• Sysmon Configuration Update
• Response File Execution Via Odbcconf.EXE
• Potential Arbitrary Command Execution Via FTP.EXE
• Imports Registry Key From a File
• Replace.exe Usage
• Potential LSASS Process Dump Via Procdump

Splunk

• Windows Wmic Network Discovery
• Windows Wmic DiskDrive Discovery
• Windows Set Private Network Profile via Registry
• Windows Wmic Systeminfo Discovery
• Windows Net System Service Discovery
• Windows File Collection Via Copy Utilities
• Windows Certutil Root Certificate Addition
• Windows Wmic Memory Chip Discovery
• Windows Wmic CPU Discovery
• Windows AI Platform DNS Query
• Azure Automation Runbook Created
• Azure Runbook Webhook Created
• Azure Automation Account Created
• Linux Magic SysRq Key Abuse
• Windows SQL Server Configuration Option Hunt
• Windows SQL Server xp_cmdshell Config Change
• Windows SQL Server Critical Procedures Enabled
• Windows SpeechRuntime Suspicious Child Process
• Windows SpeechRuntime COM Hijacking DLL Load
• AWS Defense Evasion Impair Security Services
• Windows Excel ActiveMicrosoftApp Child Process
• Windows DLL Module Loaded in Temp Dir
• Windows Rundll32 Load DLL in Temp Dir
• Disabling Windows Local Security Authority Defences via Registry
• Windows WMI Process And Service List

2025.08.25

Summary of Changes

Totals: 115 added / 62 modified
Intelligence: 0 added / 0 modified
Detections: 111 added / 59 modified
Threats: 1 added / 0 modified
Attack Scripts: 3 added / 2 modified
Collections: 0 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Possible SpeechRuntime Lateral Movement
• Supicious Child of SpeechRuntime
• SpeechRuntimeMove DCOM Trigger Lateral Movement

Atomic Red Team

• Masquerading cmd.exe as VEDetector.exe
• Replace DisplaySwitch.exe (Display Switcher binary) with cmd.exe
• Copy and Compress AppData Folder

Microsoft Sentinel

• Keeper Security - User MFA Changed
• Keeper Security - Password Changed
• CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware
• CYFIRMA - Medium severity TOR Node Network Indicators - Monitor Recommended Rule
• CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule
• CYFIRMA - Medium severity Malicious Phishing Network Indicators - Block Recommended Rule
• CYFIRMA - Customer Accounts Leaks Detection Rule
• CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule
• CYFIRMA - High severity TOR Node Network Indicators - Monitor Recommended Rule
• CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule
• CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
• CYFIRMA - Medium severity Trojan Network Indicators - Block Recommended Rule
• CYFIRMA - High severity Trojan File Hash Indicators with Monitor Action Rule
• CYFIRMA - Attack Surface - Weak Certificate Exposure - Medium Rule
• CYFIRMA - High severity Trojan File Hash Indicators with Block Action Rule
• CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule
• CYFIRMA - Medium Severity Attack Surface based Vulnerabilities Rule
• CYFIRMA - High severity File Hash Indicators with Block Action Rule
• CYFIRMA - Attack Surface - Open Ports High Rule
• CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure High Rule
• CYFIRMA - High severity File Hash Indicators with Monitor Action Rule
• CYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended Rule
• CYFIRMA - Public Accounts Leaks Detection Rule
• CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule
• CYFIRMA - Medium severity File Hash Indicators with Block Action Rule
• CYFIRMA - Medium severity Trojan File Hash Indicators with Monitor Action Rule
• CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
• CYFIRMA - High Severity Asset based Vulnerabilities Rule Alert
• CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
• CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
• CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule
• CYFIRMA - High Severity Attack Surface based Vulnerabilities Rule Alert
• CYFIRMA - Medium severity Malicious Network Indicators with Monitor Action Rule
• CYFIRMA - Brand Intelligence - Domain Impersonation High Rule
• CYFIRMA - High severity Malicious Network Indicators with Block Action Rule
• CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule
• CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule
• CYFIRMA - Data Breach and Web Monitoring - Dark Web High Rule
• CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure Medium Rule
• CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
• CYFIRMA - Medium severity File Hash Indicators with Monitor Action and Malware
• CYFIRMA - Compromised Employees Detection Rule
• CYFIRMA - Medium severity File Hash Indicators with Monitor Action Rule
• CYFIRMA - Medium severity Trojan Network Indicators - Monitor Recommended Rule
• CYFIRMA - Medium severity Malicious Phishing Network Indicators - Monitor Recommended Rule
• CYFIRMA - Brand Intelligence - Product/Solution High Rule
• CYFIRMA - High severity Malicious Network Indicators with Monitor Action Rule
• CYFIRMA - Attack Surface - Malicious Domain/IP Reputation High Rule
• CYFIRMA - Attack Surface - Configuration Medium Rule
• CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule
• CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule
• CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
• CYFIRMA - Medium severity Malicious Network Indicators with Block Action Rule
• CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule
• CYFIRMA - Brand Intelligence - Executive/People Impersonation High Rule
• CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule
• CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware
• CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule
• CYFIRMA - Medium Severity Asset based Vulnerabilities Rule Alert
• CYFIRMA - Attack Surface - Malicious Domain/IP Reputation Medium Rule
• CYFIRMA - High severity Malicious Phishing Network Indicators - Monitor Recommended Rule
• CYFIRMA - Attack Surface - Cloud Weakness High Rule
• CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
• CYFIRMA - High severity Trojan Network Indicators - Block Recommended Rule
• CYFIRMA - High severity Trojan Network Indicators - Monitor Recommended Rule
• CYFIRMA - Attack Surface - Cloud Weakness Medium Rule
• CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule
• CYFIRMA - Medium severity TOR Node Network Indicators - Block Recommended Rule
• CYFIRMA - Attack Surface - Open Ports Medium Rule
• CYFIRMA - Attack Surface - Configuration High Rule
• CYFIRMA - High severity File Hash Indicators with Block Action and Malware
• CYFIRMA - Brand Intelligence - Executive/People Impersonation Medium Rule
• CYFIRMA - High severity TOR Node Network Indicators - Block Recommended Rule
• CYFIRMA - Brand Intelligence - Product/Solution Medium Rule
• CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
• CYFIRMA - Medium severity Trojan File Hash Indicators with Block Action Rule
• CYFIRMA - Brand Intelligence - Domain Impersonation Medium Rule

Sigma Community Rules

• Windows Recovery Environment Disabled Via Reagentc
• Potential JLI.dll Side-Loading

Splunk

• Cisco Configuration Archive Logging Analysis
• Cisco Network Interface Modifications
• Cisco Smart Install Port Discovery and Status
• Cisco Secure Firewall - Static Tundra Smart Install Abuse
• Cisco SNMP Community String Configuration Changes
• Cisco TFTP Server Configuration for Data Exfiltration
• Cisco Smart Install Oversized Packet Detection
• Cisco IOS Suspicious Privileged Account Creation
• Windows RDP Server Registry Entry Created
• Windows RDP Bitmap Cache File Creation
• Windows RDP Client Launched with Admin Session
• Windows Advanced Installer MSIX with AI_STUBS Execution
• Windows RDP Server Registry Deletion
• Windows Default RDP File Creation
• Windows Default Rdp File Unhidden
• Windows PowerShell Script From WindowsApps Directory
• Windows Default Rdp File Deletion
• Windows Rdp AutomaticDestinations Deletion
• Windows RDP Cache File Deletion
• Windows Developer-Signed MSIX Package Installation
• Windows AppX Deployment Unsigned Package Installation
• Windows MSIX Package Interaction
• Windows AppX Deployment Full Trust Package Installation
• Windows PowerShell MSIX Package Installation
• Windows RDP Login Session Was Established
• Windows AppX Deployment Package Installation Success
• Windows Suspicious VMWare Tools Child Process
• Linux Medusa Rootkit
• Windows Gdrive Binary Activity
• Linux Gdrive Binary Activity

Content Updated

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• abuse of linux magic system request key for reboot
• Execute a process from a directory masquerading as the current parent directory

LOLDrivers

• Malicious Driver Load (sha1)
• Malicious Driver Load (md5)
• Malicious Driver Load Despite HVCI (md5)
• Malicious Driver Load By Name
• Vulnerable Driver Load By Name
• Malicious Driver Load Despite HVCI (sha256)
• Vulnerable Driver Load Despite HVCI (sha256)
• Malicious Driver Load Despite HVCI (sha1)
• Vulnerable Driver Load (sha256)
• Vulnerable Driver Load (md5)
• Malicious Driver Load (sha256)
• Vulnerable Driver Load (sha1)
• Vulnerable Driver Load Despite HVCI (sha1)
• Vulnerable Driver Load Despite HVCI (md5)

Microsoft Sentinel

• TI map IP entity to DNS Events (ASIM DNS schema)
• TI map IP entity to AzureFirewall

Sigma Community Rules

• Potential WerFault ReflectDebugger Registry Value Abuse
• DNS Query To Devtunnels Domain
• Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
• New BgInfo.EXE Custom VBScript Registry Configuration
• Active Directory Database Snapshot Via ADExplorer
• New BgInfo.EXE Custom WMI Query Registry Configuration
• New Federated Domain Added
• New Network Route Added
• Windows Binaries Write Suspicious Extensions
• AWS CloudTrail Important Change
• Create Volume Shadow Copy with Powershell
• Potential PendingFileRenameOperations Tampering
• New Network ACL Entry Added
• Browser Execution In Headless Mode
• Hiding User Account Via SpecialAccounts Registry Key
• Disabling Multi Factor Authentication
• Cloudflared Tunnels Related DNS Requests
• New BgInfo.EXE Custom DB Path Registry Configuration
• Virtualbox Driver Installation or Starting of VMs
• Suspicious Active Directory Database Snapshot Via ADExplorer
• File Download with Headless Browser
• Potential Bucket Enumeration on AWS
• Potential Data Stealing Via Chromium Headless Debugging
• Suspicious Inbox Forwarding Identity Protection
• AWS Config Disabling Channel/Recorder
• File or Folder Permissions Modifications
• Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
• Suspicious Chromium Browser Instance Executed With Custom Extension
• ADExplorer Writing Complete AD Snapshot Into .dat File
• Powershell Executed From Headless ConHost Process
• Chromium Browser Instance Executed With Custom Extension
• Remote Access Tool - MeshAgent Command Execution via MeshCentral
• Startup/Logon Script Added to Group Policy Object
• Network Connection Initiated To BTunnels Domains

Splunk

• Cisco Secure Firewall - Intrusion Events by Threat Activity
• Windows Phishing Recent ISO Exec Registry
• Splunk AppDynamics Secure Application Alerts
• Remcos client registry install entry
• Windows Impair Defense Overide Win Defender Phishing Filter
• Windows Rundll32 Load DLL in Temp Dir
• Windows Audit Policy Auditing Option Modified - Registry
• Windows AD Replication Request Initiated from Unsanctioned Location
• Windows AD Replication Request Initiated by User Account

2025.08.11

Summary of Changes

Totals: 217 added / 67 modified
Intelligence: 0 added / 0 modified
Detections: 217 added / 66 modified
Threats: 0 added / 0 modified
Attack Scripts: 0 added / 0 modified
Collections: 0 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Unusual Process Load Mozilla NSS-Mozglue Module
• Unusual Intelliform Storage Registry Access
• Medusa Rootkit
• Unusual FileZilla XML Config Access
• SharePoint ToolPane Endpoint Exploitation Attempt
• SharePoint Spinstall0 Webshell File Creation
• SharePoint Spinstall0 GET Request
• Potential CitrixBleed 2 Memory Disclosure

Microsoft Sentinel

• Rubrik Critical Anomaly
• Rubrik Threat Monitoring
• Digital Content Theft (High)
• Suspicious Email (Low)
• User Credentials Web App (High)
• Phish Redirector (Low)
• Targeted Malware (Low)
• Employee Credentials 3Rd Party (Informational)
• Attack Indication (Low)
• Data Leakage (Low)
• Trap 10 (Informational)
• Pharming (Medium)
• Unauthorized Association (Informational)
• Spam (Informational)
• Leaked Credential (Low)
• Breached Credential (Low)
• Exposed Email Address (Informational)
• Doorway Page (Medium)
• Domain Infringement (Informational)
• Employee Credentials Internal (Informational)
• Money Mule Account (High)
• Spam (Low)
• Phishing (Medium)
• Unauthorized Association (Medium)
• Leaked Credential (Medium)
• Malware (Informational)
• Malware (High)
• Compromised Cards (Medium)
• Vishing (High)
• User Credentials Mobile App (Low)
• Attack Indication (High)
• Subdomain Infringement (Low)
• Malicious Ip (Informational)
• User Credentials Web App (Informational)
• Employee Credentials Internal (Medium)
• Data Leakage (High)
• Survey Scam (High)
• Brand Harassment (High)
• Spam (Medium)
• Dark Web (Medium)
• Employee Credentials 3Rd Party (High)
• Brand Harassment (Medium)
• Social Engineering Vulnerability (Informational)
• Malicious Redirector (Low)
• Employee Credentials Internal (High)
• Brand Abuse (Low)
• Compromised Cards (Informational)
• Pharming (Informational)
• Data Leakage (Informational)
• Apt (Low)
• Code Repo (Informational)
• Exposed Email Address (Medium)
• Hacker Chatter (Informational)
• Data Leakage (Medium)
• Compromised Cards (Low)
• Pharming (Low)
• Brand Harassment (Low)
• Vip Credential (High)
• Vip Credential (Low)
• Vishing (Low)
• Code Repository (Low)
• Trap 10 (High)
• Phishing (Low)
• Inaccurate Content (High)
• Trap 10 (Medium)
• Suspicious Email (Informational)
• Subdomain Infringement (Informational)
• Malicious Redirector (High)
• Suspicious Mobile App (Medium)
• Code Repository (High)
• Exposed Misconfiguration (Informational)
• Suspicious Email (High)
• Smshing (High)
• Malicious Ip (Medium)
• Executive Leaks (High)
• Smshing (Medium)
• Social Engineering Vulnerability (High)
• Apt (High)
• Malicious Domain (Medium)
• Leaked Credential (Informational)
• Breached Credential (High)
• Hacker Chatter (High)
• Employee Credentials 3Rd Party (Medium)
• Brand Abuse (High)
• Attack Indication (Medium)
• Baiting News Site (Medium)
• Subdomain Infringement (High)
• Executive Leaks (Medium)
• Baiting News Site (Low)
• Vishing (Medium)
• Spam (High)
• Malware (Low)
• Phishing (Informational)
• Money Mule Account (Medium)
• Domain Infringement (High)
• Subdomain Infringement (Medium)
• Unauthorized Association (Low)
• Dark Web (Informational)
• Unauthorized Job Posting (Low)
• User Credentials Mobile App (Informational)
• Doorway Page (Informational)
• Baiting News Site (High)
• Phish Redirector (High)
• Breached Credential (Medium)
• Cyber Evil Twin Site (Low)
• Suspicious Documents (Medium)
• Malicious Redirector (Informational)
• Social Engineering Vulnerability (Medium)
• Employee Credentials Internal (Low)
• Suspicious Email (Medium)
• Apt (Informational)
• Targeted Malware (Informational)
• Domain Infringement (Low)
• User Credentials Mobile App (High)
• Suspicious Documents (Low)
• Compromised Cards (High)
• Exposed Misconfiguration (High)
• Auto Generated Page (Informational)
• User Credentials Web App (Low)
• Code Repo (High)
• Suspicious Documents (High)
• Domain Infringement (Medium)
• Dark Web (Low)
• Code Repository (Medium)
• Smshing (Low)
• Vip Credential (Medium)
• Malicious Domain (High)
• Survey Scam (Low)
• Inaccurate Content (Informational)
• Malicious Ip (High)
• Apt (Medium)
• Suspicious Documents (Informational)
• Phish Redirector (Informational)
• Targeted Malware (Medium)
• Targeted Malware (High)
• Suspicious Mobile App (Low)
• Unauthorized Job Posting (Informational)
• Dark Web (High)
• Exposed Email Address (Low)
• Social Engineering Vulnerability (Low)
• Survey Scam (Informational)
• Employee Credentials 3Rd Party (Low)
• Vip Credential (Informational)
• Executive Leaks (Low)
• Auto Generated Page (Medium)
• Pharming (High)
• Malicious Domain (Low)
• Malicious Domain (Informational)
• Code Repo (Medium)
• Money Mule Account (Informational)
• Smshing (Informational)
• Phish Redirector (Medium)
• Unauthorized Job Posting (High)
• Executive Leaks (Informational)
• Inaccurate Content (Medium)
• Vishing (Informational)
• Money Mule Account (Low)
• Doorway Page (Low)
• User Credentials Mobile App (Medium)
• Unauthorized Association (High)
• Brand Abuse (Medium)
• Hacker Chatter (Medium)
• Cyber Evil Twin Site (High)
• Hacker Chatter (Low)
• Brand Harassment (Informational)
• Code Repo (Low)
• Inaccurate Content (Low)
• Exposed Misconfiguration (Low)
• Brand Abuse (Informational)
• Cyber Evil Twin Site (Informational)
• Unauthorized Job Posting (Medium)
• Digital Content Theft (Informational)
• Attack Indication (Informational)
• User Credentials Web App (Medium)
• Survey Scam (Medium)
• Auto Generated Page (High)
• Digital Content Theft (Medium)
• Malware (Medium)
• Malicious Ip (Low)
• Trap 10 (Low)
• Digital Content Theft (Low)
• Doorway Page (High)
• Malicious Redirector (Medium)
• Breached Credential (Informational)
• Cyber Evil Twin Site (Medium)
• Baiting News Site (Informational)
• Exposed Misconfiguration (Medium)
• User IAM Enumeration
• Unauthorized EC2 Instance Setup Attempt
• Anvilogic Alert
• Conditional Access - Dynamic Group Exclusion Changes
• Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)
• Conditional Access - A Conditional Access policy was deleted
• Conditional Access - A Conditional Access app exclusion has changed
• Conditional Access - A Conditional Access policy was put into report-only mode
• Conditional Access - A Conditional Access policy was disabled
• Conditional Access - A Conditional Access user/group/role exclusion has changed
• Conditional Access - A new Conditional Access policy was created
• Conditional Access - A Conditional Access policy was updated

Sigma Community Rules

• Password Set to Never Expire via WMI
• Suspicious File Created in Outlook Temporary Directory
• Suspicious File Write to SharePoint Layouts Directory
• Windows Defender Context Menu Removed
• Windows Defender Threat Severity Default Action Modified
• PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'
• Delete Defender Scan ShellEx Context Menu Registry Key
• Disabling Windows Defender WMI Autologger Session via Reg.exe

Splunk

• Splunk AppDynamics Secure Application Alerts
• Windows Rundll32 Load DLL in Temp Dir

Content Updated

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Chronicle Detection Rules

• Ttp Windows Sharepoint Cve 2025 53770 Webshell Succeeded

Microsoft Sentinel

• Leaked Credential
• Subdomain Infringement
• Brand Impersonation - HIGH
• Suspicious Mobile App High
• Header: X-Frame-Options Missing - Low
• Executive Impersonation
• Domain Infringement
• Exposed Email Address
• Header: X-Frame-Options Missing - Informational
• SPF Policy Set to Soft Fail
• SPF Not Configured
• Phishing
• Auto Generated Page
• Brand Abuse
• Suspicious Mobile App INFO
• Brand Impersonation - INFO
• Compromised Cards
• Code Repository
• Cisco Cloud Security - 'Blocked' User-Agents.
• Cisco Cloud Security - High values of Uploaded Data
• Cisco Cloud Security - Anomalous FQDNs for domain
• Creation of Access Key for IAM User
• Cisco Cloud Security - Request Allowed to harmful/malicious URI category
• Cisco Cloud Security - Crypto Miner User-Agent Detected
• Cisco Cloud Security - DNS requests to unreliable categories.
• Cisco Cloud Security - URI contains IP address
• Cisco Cloud Security - Possible data exfiltration
• Cisco Cloud Security - DNS Errors.
• Cisco Cloud Security - Empty User Agent Detected
• Cisco Cloud Security - Rare User Agent Detected
• Cisco Cloud Security - Hack Tool User-Agent Detected
• Cisco Cloud Security - Proxy 'Allowed' to unreliable categories.
• Cisco Cloud Security - Higher values of count of the Same BytesIn size
• Cisco Cloud Security - Windows PowerShell User-Agent Detected
• Cisco Cloud Security - Request to blocklisted file type
• Cisco Cloud Security - Possible connection to C2.
• Cisco Cloud Security - Connection to Unpopular Website Detected
• Cisco Cloud Security - Requests to uncategorized resources
• Cisco Cloud Security - Connection to non-corporate private network
• Microsoft Entra ID UserAgent OS Missmatch
• Changes to Amazon VPC settings

Sigma Community Rules

• Windows Event Log Access Tampering Via Registry
• Suspicious Dropbox API Usage
• Network Connection Initiated To Mega.nz
• Network Connection Initiated To DevTunnels Domain
• Network Connection Initiated To Visual Studio Code Tunnels Domain
• Network Connection Initiated To Cloudflared Tunnels Domains
• Suspicious Non-Browser Network Communication With Telegram API
• Network Connection Initiated To BTunnels Domains
• Process Initiated Network Connection To Ngrok Domain
• Suspicious Double Extension Files
• Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create
• Usage Of Web Request Commands And Cmdlets - ScriptBlock
• Suspicious Invoke-WebRequest Execution
• Usage Of Web Request Commands And Cmdlets
• PowerShell Script With File Upload Capabilities
• Potential Data Exfiltration Activity Via CommandLine Tools
• Suspicious Invoke-WebRequest Execution With DirectIP
• Change User Agents with WebRequest
• Potential DLL File Download Via PowerShell Invoke-WebRequest
• PowerShell Download and Execution Cradles
• Suspicious PowerShell In Registry Run Keys
• Obfuscated IP Download Activity

Splunk

• Cobalt Strike Named Pipes
• Azure AD Multiple Denied MFA Requests For User

2025.07.28

Summary of Changes

Totals: 61 added / 29 modified
Intelligence: 0 added / 0 modified
Detections: 56 added / 26 modified
Threats: 0 added / 0 modified
Attack Scripts: 3 added / 2 modified
Collections: 2 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• PowerShell FakeCAPTCHA Clipboard Execution
• Interlock Ransomware
• RunMRU Command Execution

SnapAttack Community

• SnapAttack Replay Test Pack

Atomic Red Team

• Decrypt Eicar File and Write to File
• ClickFix Campaign - Abuse RunMRU to Launch mshta via PowerShell
• T1027.013 Encrypted/Encoded File

Chronicle Detection Rules

• Ttp Windows W3Wp Launching Encoded Powershell
• Ttp Windows Suspicious Filewrites To Sharepoint Layouts
• Ttp Sharepoint Cve 2025 49706 Exploitation
• Ttp Windows Sharepoint Cve 2025 53770 Webshell Attempted
• Ttp Windows Sharepoint Cve 2025 53770 Webshell Succeeded
• Ttp Windows Potential Sharpyshell Webshell Execution

Microsoft Sentinel

• Creation of Access Key for IAM User

Sigma Community Rules

• SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
• Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators
• Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create
• Potential SSH Tunnel Persistence Install Using A Scheduled Task
• ADExplorer Writing Complete AD Snapshot Into .dat File

Splunk

• Cisco Duo Admin Login Unusual Browser
• Cisco Duo Policy Allow Old Java
• Cisco Duo Policy Bypass 2FA
• Windows SharePoint Spinstall0 Webshell File Creation
• Cisco Duo Bulk Policy Deletion
• Cisco Duo Policy Allow Devices Without Screen Lock
• Cisco Duo Bypass Code Generation
• Cisco Duo Policy Allow Old Flash
• Windows SharePoint ToolPane Endpoint Exploitation Attempt
• Cisco Duo Policy Allow Tampered Devices
• Cisco Duo Policy Allow Network Bypass 2FA
• Cisco Duo Admin Login Unusual Country
• Cisco Duo Policy Deny Access
• Cisco Duo Set User Status to Bypass 2FA
• Cisco Duo Admin Login Unusual Os
• Cisco Duo Policy Skip 2FA for Other Countries
• Windows SharePoint Spinstall0 GET Request
• Windows Unusual Process Load Mozilla NSS-Mozglue Module
• Windows Unusual FileZilla XML Config Access
• Windows Unusual Intelliform Storage Registry Access
• ESXi Reverse Shell Patterns
• ESXi Syslog Config Change
• ESXi Audit Tampering
• ESXi Sensitive Files Accessed
• ESXi System Clock Manipulation
• ESXi Loghost Config Tampering
• ESXi SSH Enabled
• ESXi Account Modified
• ESXi System Information Discovery
• ESXi Encryption Settings Modified
• Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt
• ESXi Download Errors
• Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure
• ESXi SSH Brute Force
• ESXi Shared or Stolen Root Account
• ESXi User Granted Admin Role
• ESXi External Root Login Activity
• ESXi VM Exported via Remote Tool
• ESXi Firewall Disabled
• ESXi VIB Acceptance Level Tampering
• ESXi Shell Access Enabled
• ESXi Lockdown Mode Disabled

Content Updated

SnapAttack Subscribers (subscribers only)

• Bulk System Reconnaissance

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• HKCU - Policy Settings Explorer Run Key
• Process Hollowing in Go using CreateProcessW and CreatePipe WinAPIs (T1055.012)

Microsoft Sentinel

• TI map IP entity to DNS Events (ASIM DNS schema)
• TI map Domain entity to Web Session Events (ASIM Web Session schema)
• TI map IP entity to Web Session Events (ASIM Web Session schema)
• New User Assigned to Privileged Role
• Multiple admin membership removals from newly created admin.
• New External User Granted Admin Role
• Threat Essentials - Multiple admin membership removals from newly created admin.
• NRT User added to Microsoft Entra ID Privileged Groups
• NRT Privileged Role Assigned Outside PIM
• Threat Essentials - NRT User added to Microsoft Entra ID Privileged Groups
• User Assigned New Privileged Role
• Power Platform - Account added to privileged Microsoft Entra roles
• User added to Microsoft Entra ID Privileged Groups

Sigma Community Rules

• Added Credentials to Existing Application
• Potential Defense Evasion Via Binary Rename
• Unsigned DLL Loaded by Windows Utility
• Suspicious Volume Shadow Copy VSS_PS.dll Load
• Active Directory Database Snapshot Via ADExplorer
• System File Execution Location Anomaly
• Transferring Files with Credential Data via Network Shares
• Suspicious Active Directory Database Snapshot Via ADExplorer
• Removal of Potential COM Hijacking Registry Keys
• COM Hijacking via TreatAs

Splunk

• Windows Gather Victim Network Info Through Ip Check Web Services
• Recon Using WMI Class

2025.07.14

Summary of Changes

Totals: 35 added / 164 modified
Intelligence: 0 added / 0 modified
Detections: 35 added / 161 modified
Threats: 0 added / 0 modified
Attack Scripts: 0 added / 2 modified
Collections: 0 added / 1 modified

Content Added

SnapAttack Subscribers (subscribers only)

• Auditd Daemon Abort
• Suspicious Network Connection Initiated via MsXsl
• Non-Network Binary Making Network Connection
• MSHTML or MSHTA Without URL in CLI
• Bulk System Reconnaissance
• Linux FTP Activity

Microsoft Sentinel

• Endace - Pivot-to-Vision

Sigma Community Rules

• Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
• FileFix - Command Evidence in TypedPaths from Browser File Upload Abuse
• Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
• Attempts of Kerberos Coercion Via DNS SPN Spoofing
• Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network
• Proxy Execution via Vshadow
• HackTool - Doppelanger LSASS Dumper Execution
• HackTool - HollowReaper Execution
• Potential Notepad++ CVE-2025-49144 Exploitation

Splunk

• Cisco NVM - Non-Network Binary Making Network Connection
• Cisco NVM - Suspicious File Download via Headless Browser
• Cisco NVM - Suspicious Download From File Sharing Website
• Cisco NVM - Suspicious Network Connection to IP Lookup Service API
• Cisco NVM - Rundll32 Abuse of MSHTML.DLL for Payload Download
• Cisco NVM - Suspicious Network Connection From Process With No Args
• Cisco NVM - Webserver Download From File Sharing Website
• Windows File Download Via PowerShell
• Cisco NVM - Outbound Connection to Suspicious Port
• Cisco NVM - Curl Execution With Insecure Flags
• Cisco NVM - Rclone Execution With Network Activity
• CrowdStrike Falcon Stream Alerts
• Cisco NVM - Susp Script From Archive Triggering Network Activity
• Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI
• Cisco NVM - Installation of Typosquatted Python Package
• Cisco NVM - Suspicious Network Connection Initiated via MsXsl
• Linux Auditd Auditd Daemon Abort
• Linux Auditd Auditd Daemon Shutdown
• Linux Auditd Auditd Daemon Start

Content Updated

SnapAttack Subscribers (subscribers only)

• Binary Executed within 7zip

SnapAttack Community

• CISA - Known Exploited Vulnerabilities

Atomic Red Team

• Azure - Functions code upload - Functions code injection via File Share modification to retrieve the Functions identity access token
• Azure - Functions code upload - Functions code injection via Blob upload

LOLDrivers

• Vulnerable Driver Load (sha256)
• Malicious Driver Load By Name
• Malicious Driver Load (sha1)
• Vulnerable Driver Load By Name
• Malicious Driver Load Despite HVCI (md5)
• Vulnerable Driver Load Despite HVCI (sha1)
• Malicious Driver Load Despite HVCI (sha256)
• Vulnerable Driver Load (md5)
• Malicious Driver Load (md5)
• Malicious Driver Load Despite HVCI (sha1)
• Vulnerable Driver Load Despite HVCI (md5)
• Vulnerable Driver Load Despite HVCI (sha256)
• Vulnerable Driver Load (sha1)
• Malicious Driver Load (sha256)

Microsoft Sentinel

• User added to Microsoft Entra ID Privileged Groups
• NRT User added to Microsoft Entra ID Privileged Groups
• TI Map IP Entity to CommonSecurityLog
• TI map IP entity to AzureFirewall
• TI map Domain entity to Dns Events (ASIM DNS Schema)
• TI Map IP Entity to Duo Security
• TI map Domain entity to EmailEvents
• TI map Domain entity to Cloud App Events
• TI map IP entity to Cloud App Events
• TI map File Hash to DeviceFileEvents Event
• TI Map URL Entity to EmailUrlInfo
• TI map Email entity to SecurityEvent
• TI map IP entity to Web Session Events (ASIM Web Session schema)
• TI map Email entity to OfficeActivity
• TI map Email entity to EmailEvents
• TI Map URL Entity to PaloAlto Data
• TI Map IP Entity to VMConnection
• TI map IP entity to AppServiceHTTPLogs
• TI map Email entity to SecurityAlert
• TI Map URL Entity to AuditLogs
• TI map Domain entity to DnsEvents
• TI map IP entity to GitHub_CL
• TI Map IP Entity to DnsEvents
• TI Map IP Entity to AzureActivity
• TI map IP entity to OfficeActivity
• TI map IP entity to Azure Key Vault logs
• TI Map IP Entity to Azure SQL Security Audit Events
• TI map IP entity to AWSCloudTrail
• TI Map Domain Entity to DeviceNetworkEvents
• TI Map URL Entity to SecurityAlert Data
• TI Map URL Entity to Syslog Data
• TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs)
• TI map Email entity to AzureActivity
• TI Map IP Entity to SigninLogs
• TI map Domain entity to PaloAlto CommonSecurityLog
• TI map IP entity to Workday(ASimAuditEventLogs)
• TI map Email entity to Cloud App Events
• TI map Domain entity to SecurityAlert
• TI map Domain entity to EmailUrlInfo
• TI map Domain entity to Syslog
• TI Map IP Entity to DeviceNetworkEvents
• TI map Email entity to SigninLogs
• TI Map URL Entity to DeviceNetworkEvents
• TI map IP entity to Network Session Events (ASIM Network Session schema)
• TI map File Hash to Security Event
• TI map IP entity to DNS Events (ASIM DNS schema)
• TI map Domain entity to Web Session Events (ASIM Web Session schema)
• TI map File Hash to CommonSecurityLog Event
• TI map Domain entity to PaloAlto
• TI map Email entity to PaloAlto CommonSecurityLog
• TI map URL entity to Cloud App Events
• TI Map URL Entity to UrlClickEvents
• TI Map IP Entity to W3CIISLog
• NRT Authentication Methods Changed for VIP Users
• TI Map IP Entity to CommonSecurityLog

Sigma Community Rules

• Remote Thread Creation In Uncommon Target Image
• Scheduled TaskCache Change by Uncommon Program
• Remote Thread Creation By Uncommon Source Image
• Potential Binary Or Script Dropper Via PowerShell
• Suspicious Sysmon as Execution Parent
• Remote Thread Created In Shell Application
• Use Short Name Path in Command Line
• CurrentVersion NT Autorun Keys Modification
• Modification of IE Registry Settings
• Rare Remote Thread Creation By Uncommon Source Image
• Suspicious Userinit Child Process
• Potential Active Directory Reconnaissance/Enumeration Via LDAP
• ADS Zone.Identifier Deleted By Uncommon Application
• Malicious PowerShell Commandlets - ProcessCreation
• Malicious PowerShell Scripts - PoshModule
• Potential AS-REP Roasting via Kerberos TGT Requests
• Malicious PowerShell Commandlets - ScriptBlock
• Malicious PowerShell Commandlets - PoshModule
• Malicious PowerShell Scripts - FileCreation
• Suspicious SignIns From A Non Registered Device
• Program Executed Using Proxy/Local Command Via SSH.EXE
• Uncommon New Firewall Rule Added In Windows Firewall Exception List
• Emotet Loader Execution Via .LNK File
• Suspicious Download From File-Sharing Website Via Bitsadmin
• Manual Execution of Script Inside of a Compressed File
• Disk Image Creation Via Hdiutil - MacOS
• Driver Added To Disallowed Images In HVCI - Registry
• Shell Invocation via Env Command - Linux
• Shell Execution via Nice - Linux
• Bad Opsec Defaults Sacrificial Processes With Improper Arguments
• Hiding User Account Via SpecialAccounts Registry Key - CommandLine
• Shell Execution via Git - Linux
• File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
• Shell Execution via Flock - Linux
• Process Deletion of Its Own Executable
• Disk Image Mounting Via Hdiutil - MacOS
• Suspicious Remote AppX Package Locations
• Shell Invocation Via Ssh - Linux
• Potential File Override/Append Via SET Command
• FakeUpdates/SocGholish Activity
• Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
• Multi Factor Authentication Disabled For User Account
• Group Policy Abuse for Privilege Addition
• Suspicious Child Process Of Wermgr.EXE
• Inline Python Execution - Spawn Shell Via OS System Library
• Antivirus Filter Driver Disallowed On Dev Drive - Registry
• Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
• FileFix - Suspicious Child Process from Browser File Upload Abuse
• Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
• HackTool - SharpWSUS/WSUSpendu Execution
• COM Object Hijacking Via Modification Of Default System CLSID Default Value
• Shell Execution via Find - Linux
• Suspicious Process Masquerading As SvcHost.EXE
• DNS Query To Put.io - DNS Client
• Suspicious Invocation of Shell via AWK - Linux
• Shell Execution GCC - Linux
• User Risk and MFA Registration Policy Updated
• Wusa.EXE Executed By Parent Process Located In Suspicious Location
• Capsh Shell Invocation - Linux
• Hidden Flag Set On File/Directory Via Chflags - MacOS
• Potentially Suspicious Rundll32.EXE Execution of UDL File
• Data Export From MSSQL Table Via BCP.EXE