Vendor
Intel NPU Driver Vulnerabilities Allow Privilege Escalation and DoS
2 rules 2 TTPsMultiple vulnerabilities in the Intel NPU Driver allow a local attacker to escalate privileges and cause a denial of service.
Dell Security Advisory Addresses Vulnerabilities in Multiple Products
2 rulesDell published security advisories between May 11 and 17, 2026, addressing vulnerabilities in Dell Enterprise Sonic Distribution, Dell Live Optics Collector, Intel 800 Series Ethernet Adapters, Dell PowerEdge with AMD Graphics, and PowerScale InsightIQ, prompting users to apply necessary updates.
BIG-IP VE TMM Termination Vulnerability (CVE-2026-40618)
2 rules 1 TTP 1 CVECVE-2026-40618 describes a vulnerability in F5 BIG-IP Virtual Edition (VE) where specific traffic can cause the Traffic Management Microkernel (TMM) to terminate when an SSL profile is configured without Intel QuickAssist Technology (QAT) or with crypto.hwacceleration disabled, potentially leading to a denial-of-service.
Intel Server Firmware Update Utility Software Privilege Escalation Vulnerability
2 rules 1 TTPA local attacker can exploit a vulnerability in Intel Server Firmware Update Utility Software to escalate their privileges on the targeted system.
Intel Addresses Vulnerabilities in Multiple Software Products
3 rulesIntel released security advisories addressing vulnerabilities in Display Virtualization for Windows OS driver software, Intel EMA software, AI Playground software, and Intel Vision software, requiring users to update to the latest versions.
Multiple Vulnerabilities in Intel Firmware Allow Privilege Escalation and DoS
2 rules 3 TTPsMultiple vulnerabilities in Intel Firmware allow a local attacker to escalate privileges, cause a denial-of-service condition, or disclose sensitive information.
Command and Scripting Interpreter via Windows Scripts
2 rules 1 TTPThis rule detects the execution of PowerShell, PowerShell ISE, or Cmd spawned from Windows Script Host or MSHTA, indicating potential abuse of scripting interpreters to execute malicious commands or scripts on Windows systems.
Persistence via Windows Installer (Msiexec)
3 rules 3 TTPsAdversaries may establish persistence by abusing the Windows Installer (msiexec.exe) to create scheduled tasks or modify registry run keys, allowing for malicious code execution upon system startup or user logon.
Process Execution from Suspicious Windows Directories
2 rules 1 TTPAdversaries may execute processes from unusual default Windows directories to masquerade malware and evade defenses by blending in with trusted paths, making malicious activity harder to detect.
Suspicious Module Loaded by LSASS for Credential Access
2 rules 2 TTPsDetection of unsigned or untrusted DLLs being loaded into the LSASS process, which is indicative of credential access attempts by adversaries aiming to steal sensitive information such as user passwords.
LSASS Loading Suspicious DLL
2 rules 2 TTPs 9 IOCsDetection of LSASS loading an unsigned or untrusted DLL, which can indicate credential access attempts by malicious actors targeting sensitive information stored in the LSASS process.