logs-endpoint.events[.]networkDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 2 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages“FROM logs-endpoint.events[.]network-*”
-
One agent, the right skills: Elastic Security 9.4 brings domain expertise on demand to every SOC workflow“Using platform.core.generate_esql and platform.core.execute_esql, it iteratively builds queries against logs-endpoint.events[.]network-*:”
-
Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID“from logs-endpoint.events[.]network-*”
Indicators reported together
named in the same reports- npm-cache[.]comin 1 report
- awqhnjewqjkl[.]icuin 1 report
- process[.]pidin 1 report
- go.getblock[.]ioin 1 report
- eth-mainnet.nodereal[.]ioin 1 report
- 9fc2570b7cef51c1…fc2509cf1bccin 1 report
- fd3ca4007b225fdf…806e5684b1ebin 1 report
- 54dc7ea54a1317cc…93012b350668in 1 report
- platform.core[.]searchin 1 report
- find.security.ml[.]jobsin 1 report
- storage-sync-cdn[.]cloudin 1 report
- host.os[.]familyin 1 report
- hxxps://aytobusesre[.]com/live/in 1 report
- aytobusesre[.]comin 1 report
- hxxp://www.meow123[.]com/testin 1 report
- www.meow123[.]comin 1 report
- hxxp://www.meow123[.]com/dllin 1 report
- aee22a35cbdac3f1…63565111028cin 1 report
- scifimond[.]comin 1 report
- gyxplonto[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.