hxxp://10.100.100[.]10/machine?comp=goalstateURL

Reported by 1 independent source · first reported 24 Feb 2026 by Elastic Security Labs · last reported 24 Feb 2026

Last reported 7 months ago

What the reports say

1 report, newest first · the exact sentence from each

“{$webClient.DownloadString('hxxp://10.100.100[.]10/machine?comp=goalstate')}"; cmd.exe”

Elastic Security LabsVendor24 Feb 2026
Beyond Behaviors: AI-Augmented Detection Engineering with ES|QL COMPLETION

Indicators reported together

named in the same reports

kibana.alert.rule[.]namein 1 report
kibana.alert.rule.threat.tactic[.]namein 1 report
kibana.alert.rule.threat.technique[.]namein 1 report
hxxp://10.100.100[.]10:9090/revershell.exein 1 report
hxxp://192.168.1[.]100/payload.exein 1 report

Copy these 5 indicators · defanged

5 indicators, defanged, one per line

kibana.alert.rule[.]name
kibana.alert.rule.threat.tactic[.]name
kibana.alert.rule.threat.technique[.]name
hxxp://10.100.100[.]10:9090/revershell.exe
hxxp://192.168.1[.]100/payload.exe

Thanks — we review every report.

Report a wrong value