Securonix Connect!

Recent activity
Help others
Categories

BETA DETECTION: Browser Process Spawning Download-and-Execute Chain to Temp AnalyticBlog

name: 'Browser Process Spawning Download-and-Execute Chain to Temp Analytic'signatureid: EDR-SYM972-RUNcategory: 'Execution'threatname: 'Exploitation for Client Execution'functionality: 'Endpoint Management Systems'description: | Detects a Chromium-

1 day ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: GRIMWEDGE Persistence Scheduled Task Creation AnalyticBlog

name: 'GRIMWEDGE Persistence Scheduled Task Creation Analytic'signatureid: WEL-ACC83-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'lifecycle: experimentaldescription: | Detects creation o

1 day ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analytic

name: Gryxa Toolkit Working Directory or Component Script Referenced in Process Execution Analyticsignatureid: EDR-SYM964-RUNcategory: 'Defense Evasion'threatname: 'Masquerading: Match Legitimate Resource Name or Location'functionality: 'Endpoint Man

1 day ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: SYSTEM Scheduled Task Created with Minute Interval Executing from ProgramData or Diagnostics Path AnalyticBlog

name: SYSTEM Scheduled Task Created with Minute Interval Executing from ProgramData or Diagnostics Path Analyticsignatureid: EDR-SYM965-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Endpoint Management Syst

1 day ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

BETA DETECTION: Scheduled Task Registered with Sub-Hourly Repetition Executing from ProgramData or Diagnostics Path AnalyticBlog

name: Scheduled Task Registered with Sub-Hourly Repetition Executing from ProgramData or Diagnostics Path Analyticsignatureid: WEL-ACC82-RUNcategory: 'Persistence'threatname: 'Scheduled Task/Job: Scheduled Task'functionality: 'Microsoft Windows'descr

1 day ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

Securonix ThreatWatch Monthly Intelligence Insights – August 2026Blog

Authors: Nitish Singh, Nikhil Kumar Chadha, and Tanmay KumarIntroduction:The Monthly Intelligence Insights report provides a summary of top threats curated, monitored, and analyzed by Securonix Threat Watch in August 2026. The report also includes a

160

1 day ago

Aaron BeardsleeCommunity Manager

Threat Research & Intelligence

Mind the (Patch) Gap: Inside BlueMoon, the Chrome/Windows 0-Day Chain Two Chinese APT Clusters Fired at OnceBlog

OverviewOn September 1, 2026, Volexity's Network Security Monitoring service caught a spear-phishing email hitting multiple non-governmental organization customers. The lure was a donation-form pretext, the kind of email a fundraising team might send

300

2 days ago

Dheeraj KumarCommunity Manager

Threat Research & Intelligence

LAPSUS$ Chapter II: Signed, Staged, but Still UnattributedBlog

Executive Summary:On 9 September 2026, Securonix ThreatWatch team began tracking lapsus.ar[.]io after the site appeared online carrying "LAPSUS$ GROUP - CHAPTER II" branding. At the time of review, the site used "LAPSUS$ GROUP - CHAPTER II" branding

360

2 days ago

SimonHuntChief Product Officer

Tips & Tricks

Sam - Turn a Raw Login Event into Analyst-Ready Context with Sam

Dense security events can slow an investigation before it starts. When a log contains unfamiliar error codes, identity attributes, device posture, and application context, ask Sam, the AI SOC Analyst, to explain it in plain language. Try thisPaste th

140

6 days ago

slakshmiCommunity Manager

What’s New at Securonix

Agentic Mesh: Building the Governed AI SOC

Audience : SOC Analysts, Security Engineers, Detection Engineers, MSSPs, Security Operations LeadersProduct Module : Securonix Unified Defense SIEM | Agentic MeshLast Updated : May 21, 2026KB ID : KB-20260521-agentic-mesh-overviewTags : Agentic Mesh,

100

7 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1530

2 months ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

850

3 months ago

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1771

4 months ago

martel.williamsNew Member

Use Cases

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

730

4 months ago

makayla.smithNew Member

Use Cases

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

5292

4 months ago

martel.williamsNew Member

Show & Tell

Cloudflare WAF logs are not showing in the platform

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

3062

4 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2892

5 months ago

martel.williamsNew Member

Use Cases

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

4491

5 months ago

BrillNew Participant

Use Cases

How can I display amalgamated vulnerability intelligence on a dashboard?

I have a ton of open and closed sources feeding reports, vulnerabilities & CVE indicators into ThreatQ. Because “reports”, “vulnerabilities”, and “indicators” are all different threat libraries inside of ThreatQ, I’ve struggled to find a way to d

2381

5 months ago

Ak_098New Member

Tips & Tricks

IOC Enrichment Malware Attribution Gaps and Alternative Approaches

Currently, the RF IOC enrichment action provides only a limited set of attributes, such as risk score and malware verdict. Malware attribution, however, is not included in the enrichment results.Since we are paying for an RF license, we would like to

2181

7 months ago