Monitoring

This detection identifies potential reconnaissance activity in Azure Kubernetes Service (AKS) by flagging identities that enumerate three or more distinct Kubernetes API resource types within a short timeframe.

A high volume of failed tool invocations against an AWS Bedrock AgentCore Gateway may indicate an adversary attempting to discover injection points or authorization bypasses within AI agent infrastructure.

Malware families, including Remote Access Trojans (RATs), modify Windows registry keys to disable the Notification Center, effectively suppressing system alerts to hide malicious activity.

This detection brief provides a comprehensive list of keyword signatures for identifying malicious tool and malware execution artifacts within the Windows Application event log.

Checkmk is affected by multiple vulnerabilities, including CVE-2024-23334 through CVE-2024-23338, which may allow unauthenticated or authenticated attackers to perform cross-site scripting, information disclosure, or data manipulation.

A vulnerability in the Zabbix Frontend allows a remote, authenticated attacker to execute arbitrary scripts in a user's browser via a Cross-Site Scripting (XSS) attack.

Adversaries leverage WMI permanent event subscriptions to achieve stealthy persistence and arbitrary code execution by binding system event filters to malicious consumers.

This brief details the ingestion and correlation of Microsoft Defender Attack Surface Reduction (ASR) events to identify policy bypasses, configuration tampering, and malicious execution attempts.

Detection of unauthorized removal of success or failure audit policies on Domain Controllers, a critical defense evasion tactic used by attackers to hide malicious activity.

Adversaries may exploit the ModifySnapshotAttribute API to share Amazon EBS snapshots with external accounts or the public, facilitating data exfiltration and unauthorized access to sensitive volume data.

This brief documents the execution mechanics of Microsoft System Center Configuration Manager (SCCM), identifying risks where adversary-controlled software or scripts are deployed through the SCCM client infrastructure.

This detection identifies potential defense evasion where a newly observed network flow exporter subsequently acts as the source of suspicious security alerts within a 30-minute window.

This brief documents the detection of TeamViewer Desktop installation via file system activity, often associated with Remote Access Software usage.

This brief documents patterns in file naming conventions frequently associated with attacker toolkits, proof-of-concept exploits, and red team frameworks.

Detection of child processes spawned by winrshost.exe identifying potential lateral movement and remote command execution via Windows Remote Management (WinRM).

This brief documents the detection of file restoration events from the Microsoft Defender quarantine, a technique that can be leveraged by attackers to re-enable malicious payloads.

Between 2017 and 2020, threat actors targeted Centreon environments at IT service providers by deploying the P.A.S. webshell and the Exaramel backdoor.

A vulnerability in Veeam ONE allows a remote, unauthenticated attacker to bypass security protections, potentially leading to unauthorized access to monitoring functions.

This detection monitors for the first occurrence of an AWS identity accessing AWS Systems Manager (SSM) SecureString parameters with the decryption flag enabled, indicating potential unauthorized retrieval of stored sensitive credentials.

Monitoring for non-standard additions to the Windows Defender Firewall exception list to identify potential defense impairment activity by unauthorized processes.

Nagios Core and XI contain a CSRF protection bypass vulnerability (CVE-2026-48551) that allows unauthenticated attackers to execute commands as an authorized user via manipulated double-submit cookies.

An anomaly-based detection analytic identifying potential insider threats or data exfiltration by monitoring for high-frequency write operations to administrative network shares via Windows Event ID 5145.