Securonix Connect!

BETA DETECTION: Shadow Credentials Followed by RBCD Configuration Attack ChainBlog

name: Shadow Credentials Followed by RBCD Configuration Attack Chain Analyticsignatureid: WEL-ACC02-AEIcategory: 'Privilege Escalation'threatname: 'Valid Accounts: Domain Accounts'functionality: 'Microsoft Windows'description: | Detects a sophistica

160

Aaron BeardsleeCommunity Manager

BETA DETECTION: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials AttackBlog

name: Modification of msDS-KeyCredentialLink Attribute Shadow Credentials Attack Analyticsignatureid: WEL-ACC78-RUNcategory: 'Credential Access'threatname: 'Steal or Forge Authentication Certificates'functionality: 'Microsoft Windows'description: |

Aaron BeardsleeCommunity Manager

BETA DETECTION: PowerShell Telegram Bot API Used as Command and Control ChannelBlog

name: PowerShell Telegram Bot API Used as Command and Control Channel Analyticsignatureid: WEL-PSH137-RUNcategory: 'Command and Control'threatname: 'Web Service: Bidirectional Communication'functionality: 'Microsoft Windows Powershell'description: |

160

Aaron BeardsleeCommunity Manager

HEAVYGRAM: Inside Handala Hack's Telegram-Native Surveillance BackdoorBlog

OverviewOn September 17, 2026, Group-IB published a technical report tying a Telegram-based surveillance backdoor called HEAVYGRAM to Handala Hack, the Iran-linked "hacktivist" persona that emerged in the days after the October 7, 2023 Hamas-led atta

260

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

BatbilguunNew Member

Securonix On-Prem

Hello Team, We would like to submit an enhancement request regarding Incident Report exports.Currently, the report header fields such as Start Date and End Date correctly reflect our configured tenant timezone (Asia/Ulaanbaatar). However, the Date/Ti

7 days ago

absachinCommunity Manager

Microsoft Copilot Studio: Identity, Logging, and Threat Detection - Part I

Audience: Security Administrators, SOC Analysts, Detection Engineers, MSSPsProduct Module: Securonix SIEM / Microsoft 365 and Entra ID IntegrationLast Updated: September 21, 2026KB ID: KB-20260921-copilot-studio-threat-detection [Tentative]Tags: Micr

460

11 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: Browser Process Spawning Download-and-Execute Chain to Temp AnalyticBlog

name: 'Browser Process Spawning Download-and-Execute Chain to Temp Analytic'signatureid: EDR-SYM972-RUNcategory: 'Execution'threatname: 'Exploitation for Client Execution'functionality: 'Endpoint Management Systems'description: | Detects a Chromium-

180

14 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: GRIMWEDGE Persistence Scheduled Task Creation AnalyticBlog

name: 'GRIMWEDGE Persistence Scheduled Task Creation Analytic'signatureid: WEL-ACC83-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'lifecycle: experimentaldescription: | Detects creation o

14 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analytic

name: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analyticsignatureid: EDR-SYM964-RUNcategory: 'Defense Evasion'threatname: 'Masquerading: Match Legitimate Resource Name or Location'functionality: 'Endpoint Man

14 days ago

rbritoNew Member

Preserve TCP Source IP Metadata for Syslog Events Before Ingester Parsing

3 hours ago

BatbilguunNew Member

Securonix On-Prem

Incident Report Export Displays Date/Time and Last Status Update in UTC Instead of Asia/Ulaanbaatar

7 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1540

3 months ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

850

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1771

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

740

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

5292

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

3062

5 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2912

5 months ago

martel.williamsNew Member