Skip to content
Threat Feed

Vendor

Slack

3 briefs RSS
medium advisory

Detection of Command and Control Activity via Commonly Abused Web Services

This rule detects command and control activity using common web services by identifying Windows hosts making DNS requests to a list of commonly abused web services from processes outside of known program locations, potentially indicating adversaries attempting to blend malicious traffic with legitimate network activity.

OneDrive +7 command-and-control windows threat-detection
2r 2t
high advisory

Unusual Process Loading Mozilla NSS/Mozglue Module

Detection of processes loading Mozilla NSS/Mozglue libraries (mozglue.dll, nss3.dll) outside of known Mozilla applications, potentially indicating malware or unauthorized activity.

Firefox +9 defense-evasion anomaly windows
2r 1t
medium advisory

Masquerading Business Application Installers

Attackers masquerade malicious executables as legitimate business application installers to trick users into downloading and executing malware, leveraging defense evasion and initial access techniques.

Elastic Defend +22 masquerading defense-evasion initial-access malware windows
2r 4t