Skip to content
Threat Feed

Tag

Endpoint

4 briefs RSS
high advisory

Multiple External EDR Alerts by Host

This rule detects multiple external EDR alerts on the same host, indicating a potential compromise, by analyzing alert data from various EDR solutions like CrowdStrike, SentinelOne, and M365 Defender to identify hosts triggering multiple alerts, enabling prioritization of investigation and response.

threat-detection edr endpoint
3r 3t
high advisory

Suspicious MSIExec Remote Download

The analytic detects the execution of msiexec.exe with an HTTP or HTTPS URL, which indicates an attempt to download and execute potentially malicious software from a remote server, leading to potential unauthorized code execution, system compromise, or malware deployment.

Splunk Enterprise +3 endpoint msiexec remote-download windows
2r 2t
low advisory

Machine Learning Detects High Bytes Written to External Device

A machine learning job has detected high bytes of data written to an external device, potentially indicating illicit data copying or transfer activities leading to data exfiltration over a physical medium such as USB.

data-exfiltration machine-learning endpoint
2r 1t
low advisory

Unusual Process Spawned by a User Detected by Machine Learning

A machine learning job detected a suspicious Windows process, predicted to be malicious by the ProblemChild supervised ML model and found to be unusual within the user's context, potentially indicating defense evasion techniques like masquerading or the use of LOLbins.

endpoint windows defense evasion machine learning lolbins
2r 2t