CTE - Device Enrolled but On Hold

MediumMicrosoft Sentinel analytics

Pulumi Cloud - Stack deleted

Identifies deletion of a Pulumi stack. Stack deletion is a destructive operation that removes the stack's infrastructure state, and may be legitimate maintenance or unauthorized activity.

T1485

Licence: MIT License
Published: Oct 16, 2026

LowMicrosoft Sentinel analytics

Pulumi Cloud - Organization membership change

Identifies changes to Pulumi Cloud organization membership, including members being added, removed, or having their roles changed. These events track access control changes to the infrastructure management platform and should correspond to expected administrative activity.

T1098

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

Pulumi Cloud - Excessive authentication failures

Identifies more than five failed Pulumi Cloud login attempts (user-login-failed events) from a single IP address within a one-hour window. This may indicate a brute force attack or an attempt to use compromised credentials.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - TI - Connection from Malicious IP

This query correlates Threat Intelligence data from Microsoft Sentinel with GitLab NGINX Access Logs (available in GitLab CE as well) to identify access from potentially TI-flagged IPs.

T1078

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - Local Auth - No MFA

This query checks GitLab Audit Logs to see if a user authenticated without MFA. Ot might mean that MFA was disabled for the GitLab server or that an external authentication provider was bypassed. This rule focuses on 'admin' privileges but the parameter can be adapted to also include all users.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumMicrosoft Sentinel analytics

GitLab - Brute-force Attempts

This query relies on GitLab Application Logs to get failed logins to highlight brute-force attempts from different IP addresses in a short space of time.

T1110

Licence: MIT License
Published: Oct 16, 2026

MediumSigmaHQ

Nslookup PowerShell Download Cradle - ProcessCreation

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

T1071.004

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

MediumSigmaHQ

EVTX Created In Uncommon Location

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

T1685.001

Written by: D3F7A5105Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

HighSigmaHQ

Exchange PowerShell Cmdlet History Deleted

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

T1070

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

InformationalSplunk security content

Unusual HTTP Request Method

The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.

T1071.001T1190

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Unusual SSH Client Banner

The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.

T1021.004T1572

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

HTTP POST Request with Encoded Payload

The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.

T1071.001T1132.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Wermgr Alternate Data Stream in Temp Dir

The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions. This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.

T1564.004

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Non-System Process Querying Definition Update

Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.

T1068T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Utilities

The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Tool Bundle File Created

The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.

T1588.002

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Cloud Files Filter Loaded by Uncommon Process

The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.

T1543.003

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Windows NirSoft AdvancedRun

The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Possible Browser Pass View Parameter

The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns.

T1555.003

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Suspicious Prompt Injection Jailbreak

Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs.

T1059T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible RCE via Model Loading

Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server.

T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Model Exfiltration Data Leakage

Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations.

T1048

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Abnormal Service Crash Availability Attack

Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability.

T1489

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Detection of tools built by NirSoft

The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance.

T1072

Written by: Bhavin PatelAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Detect Large ICMP Traffic

The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert

T1095

Written by: Rico ValdezAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

ASL AWS ECR Container Upload Unknown User

The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized.

T1204.003

Written by: Patrick BareissAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

PingID New MFA Method After Credential Reset

The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device.

T1098.005T1556.006T1621

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Memory Exhaustion Resource Abuse

Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.

T1499

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible API Endpoint Scan Reconnaissance

Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.

T1595

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Excessive API Requests

Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.

T1498

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

Detection rules

CTE - Device Enrolled but On Hold

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules