Tag
TelemetryController Scheduled Task Hijack for Persistence
2 rules 1 TTPThe rule detects the hijack of the Microsoft Compatibility Appraiser scheduled task to establish persistence with system integrity level, by monitoring CompatTelRunner.exe process execution and detecting unexpected child processes.
n8n-mcp Vulnerable to Path Traversal, SSRF, and Telemetry Exposure
2 rules 1 TTPn8n-mcp versions before 2.50.1 are vulnerable to path traversal, redirect-following SSRF, and telemetry payload exposure, potentially leading to sensitive information disclosure and unauthorized access.
OpenC3 COSMOS SQL Injection Vulnerability in QuestDB Time-Series Database
2 rules 3 TTPsA SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS, allowing an authenticated remote user to execute arbitrary SQL commands, including telemetry data disclosure and deletion.
Elastic Defend Alert Followed by Telemetry Loss
2 rules 2 TTPsThis rule detects when an Elastic Defend endpoint alert is generated and is not followed by subsequent endpoint telemetry events, potentially indicating endpoint security evasion, agent tampering, or sensor disablement.