-
Potential File Download via a Headless Browser
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Resources: Investigation Guide Data Source: Windows Data Source: Elastic Endgame Data Source: Elastic Defend Data Source: Windows Security Event Logs Data Source: Microsoft Defender XDR Data Source: SentinelOne Data Source: Sysmon Data Source: Crowdstrike Noise: Medium Performance: Normal Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies headless browser execution from a suspicious parent process with arguments consistent with scripted retrieval. Adversaries use browsers because they are trusted, signed binaries that proxy and application-control policies allow through, bypassing restrictions on direct download tools.
Read More -
Suspicious Access to LDAP Attributes
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Discovery Data Source: Windows Security Event Logs Data Source: Active Directory Data Source: Windows Resources: Investigation Guide Noise: High Performance: Normal Profile: Aggressive Rule Type: Event Correlation (EQL) Platform: Windows ·Identify read access to a high number of Active Directory object attributes. The knowledge of objects properties can help adversaries find vulnerabilities, elevate privileges or collect sensitive information.
Read More