Welcome to Securonix Connect!

Aaron BeardsleeCommunity Manager

BETA DETECTION: WordPress wp2shell Post-Exploitation Persistence and Enumeration ActivityBlog

name: 'WordPress wp2shell Post-Exploitation Persistence and Enumeration Activity Analytic'signatureid: WAF-APP02-RUNcategory: 'Persistence'threatname: 'Server Software Component: Web Shell'functionality: 'Web Proxy'description: | Detects the post-ex

110

Aaron BeardsleeCommunity Manager

BETA DETECTION: WordPress REST Batch API Exploitation wp2shellBlog

name: 'WordPress REST Batch API Exploitation wp2shell Analytic'signatureid: WAF-APP01-RUNcategory: 'Initial Access'threatname: 'Exploit Public-Facing Application'functionality: 'Web Application Firewall'description: | Detects requests to the WordPre

110

Aaron BeardsleeCommunity Manager

One Missing Array Element: Inside wp2shell, the Pre-Auth RCE in WordPress CoreBlog

OverviewOn July 17, 2026, WordPress shipped a coordinated security release closing a pre-authentication remote code execution chain reachable against a typical default install, no plugins required, no login page in front of it, provided a persistent

170

Aaron BeardsleeCommunity Manager

BETA DETECTION: OTTERCOOKIE Stealer Upload to Rare DEV Domain via axios User-AgentBlog

name: OTTERCOOKIE Stealer Upload to Rare DEV Domain via axios User-Agent Analyticsignatureid: PXY-WEB11-ERIcategory: 'Exfiltration'threatname: 'Exfiltration Over C2 Channel'functionality: 'Web Proxy'description: | Detects the credential, wallet, and

Aaron BeardsleeCommunity Manager

BETA DETECTION: OTTERCOOKIE Clipboard Stealer High-Frequency Get-Clipboard PollingBlog

name: OTTERCOOKIE Clipboard Stealer High-Frequency Get-Clipboard Polling Analyticsignatureid: WEL-PSH136-RUNcategory: 'Collection'threatname: 'Clipboard Data'functionality: 'Microsoft Windows PowerShell'description: | Detects the Windows clipboard-s

Aaron BeardsleeCommunity Manager

BETA DETECTION: OTTERCOOKIE SVG Steganography Payload Reassembly and Eval ExecutionBlog

name: OTTERCOOKIE SVG Steganography Payload Reassembly and Eval Execution Analyticsignatureid: EDR-NIX26-RUNcategory: 'Execution'threatname: 'Command and Scripting Interpreter: JavaScript'functionality: 'Endpoint Management Systems'description: | De

Aaron BeardsleeCommunity Manager

Flags, Fake Jobs, and Fileless Payloads: Inside DPRK's SVG-Steganography Contagious Interview CampaignBlog

OverviewOn May 26, 2026, a user calling themselves "Maxwell" posted in the #jobs channel of Elastic's public community Slack workspace, claiming to be upgrading an e-commerce platform to "a modern, scalable architecture using Next.js (v14), NestJS, P

Dheeraj KumarCommunity Manager

Shadow Fronts: The Pro-Iran Hacktivist Ecosystem Driving Disruption, Doxxing, and OT Targeting in 2026Blog

Executive summary: Pro-Iran hacktivist activity in 2026 is best understood as a decentralized Iran-aligned mobilization network. It combines state-linked personas, semi-deniable proxy brands, regional ideological teams, and foreign hacktivist partici

140

3 days ago

Dheeraj KumarCommunity Manager

DEBULL Device-Code Phishing Against Microsoft 365Blog

Executive summary:Reporting available through July 14, 2026 indicates that DEBULL is a reusable Microsoft 365 device-code phishing broker and operator platform rather than a single phishing page. During the late June to early July campaign, attackers

500

9 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

640

24 days ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

560

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1071

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

480

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

2882

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

2162

How To Fix Delay in Searchable Period

fatimaNew Member

Show & Tell

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2242

martel.williamsNew Member

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

2461

BrillNew Participant

How can I display amalgamated vulnerability intelligence on a dashboard?

I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d

1631