Securonix Connect!

The Psychedelic Stealer: When the CAPTCHA Is the InstallerBlog

OverviewBetween September 9 and September 14, 2026, an operator compromised at least six legitimate Ukrainian small-business websites and used them to serve a fake Cloudflare verification page. The page did not exploit anything. It asked the visitor

3 hours ago

icervantesCommunity Manager

Getting started in the community

💡 Have a Product Idea? Help Shape the Future of Securonix

Have a Product Idea? Help Shape the Future of Securonix Innovation at Securonix is driven by you — our customers and partners. Whether you’ve identified a gap, experienced a challenge, or have an idea for a new feature, we want to hear from you. We’

3813

12 hours ago

Aaron BeardsleeCommunity Manager

Open Season on Kapibala: A WordPress-to-Government-Records Intrusion, Step by StepBlog

OverviewBetween June and September 2026, GreyNoise researchers tracked a single actor, publicly nicknamed "Kapibala" after the WordPress usernames it left behind, through a ten-vulnerability exploitation spree that touched WordPress sites, ZyXEL netw

110

22 hours ago

rbritoNew Member

Preserve TCP Source IP Metadata for Syslog Events Before Ingester Parsing

SummaryThe Securonix Syslog Connector should preserve the TCP peer/source IP received by syslog-ng and make it available as event metadata to the Ingester, parser, enrichment engine, and normalized event fields.Current behaviorUnix/Linux events are r

1 day ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: Shadow Credentials Followed by RBCD Configuration Attack ChainBlog

name: Shadow Credentials Followed by RBCD Configuration Attack Chain Analyticsignatureid: WEL-ACC02-AEIcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Domain Accounts'functionality: 'Microsoft Windows'description: | Detects a sophistica

160

Aaron BeardsleeCommunity Manager

BETA DETECTION: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials AttackBlog

name: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials Attack Analyticsignatureid: WEL-ACC78-RUNcategory: 'Credential Access'threatname: 'Steal or Forge Authentication Certificates'functionality: 'Microsoft Windows'description: |

Aaron BeardsleeCommunity Manager

BETA DETECTION: PowerShell Telegram Bot API Used as Command and Control ChannelBlog

name: PowerShell Telegram Bot API Used as Command and Control Channel Analyticsignatureid: WEL-PSH137-RUNcategory: 'Command and Control'threatname: 'Web Service: Bidirectional Communication'functionality: 'Microsoft Windows Powershell'description: |

170

Aaron BeardsleeCommunity Manager

HEAVYGRAM: Inside Handala Hack's Telegram-Native Surveillance BackdoorBlog

OverviewOn September 17, 2026, Group-IB published a technical report tying a Telegram-based surveillance backdoor called HEAVYGRAM to Handala Hack, the Iran-linked "hacktivist" persona that emerged in the days after the October 7, 2023 Hamas-led atta

260

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

BatbilguunNew Member

Securonix On-Prem

Hello Team, We would like to submit an enhancement request regarding Incident Report exports.Currently, the report header fields such as Start Date and End Date correctly reflect our configured tenant timezone (Asia/Ulaanbaatar). However, the Date/Ti

8 days ago

rbritoNew Member

Preserve TCP Source IP Metadata for Syslog Events Before Ingester Parsing

1 day ago

BatbilguunNew Member

Securonix On-Prem

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

8 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1540

3 months ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

850

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1771

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

740

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

5292

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

3062

5 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2912

5 months ago

martel.williamsNew Member