Welcome to Securonix Connect!

Sality's Peer List, Turned Against It: Inside the 23-Year Botnet's TakedownBlog

OverviewOn August 31, 2026, the U.S. Department of Justice, FBI, and Defense Criminal Investigative Service, working alongside law enforcement in Bulgaria, Hungary, and Romania, and in partnership with CrowdStrike's Counter Adversary Operations team

5 hours ago

sinaCCommunity Manager

Welcome to Securonix Threat Labs: From Threat Research to ActionBlog

Welcome to Securonix Threat Labs: From Threat Research to Action Cyber threats move quickly. New malware, vulnerabilities, campaigns, attack techniques, and indicators surface every day. Knowing that a threat exists, though, is only the first step.Se

270

6 days ago

Dheeraj KumarCommunity Manager

Pequod Toolkit Exposure - ThreatWatch AnalysisBlog

Executive summary:A public disclosure identified 107[.]152[.]37[.]252 as infrastructure associated with a cybercriminal operation referred to as Pequod. Securonix Threat Labs independently confirmed that the host exposed a Python HTTP directory on TC

220

7 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: JSP Web Shell File Creation in PTC Windchill Codebase AnalyticBlog

name: JSP Web Shell File Creation in PTC Windchill Codebase Analyticsignatureid: EDR-NIX28-RUNcategory: 'Persistence'threatname: 'Server Software Component: Web Shell'functionality: 'Endpoint Management Systems'description: | Detects the creation of

170

14 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: JSP Web Shell File Creation in PTC Windchill Codebase on Windows AnalyticBlog

name: JSP Web Shell File Creation in PTC Windchill Codebase on Windows Analyticsignatureid: EDR-SYM962-RUNcategory: 'Persistence'threatname: 'Server Software Component: Web Shell'functionality: 'Endpoint Management Systems'description: | Detects the

14 days ago

Aaron BeardsleeCommunity Manager

BETA DETECTION: PTC FlexPLM WSDL Pre-Authentication Reconnaissance Fingerprint AnalyticBlog

name: PTC FlexPLM WSDL Pre-Authentication Reconnaissance Fingerprint Analyticsignatureid: PXY-WEB14-RUNcategory: 'Reconnaissance'threatname: 'Active Scanning: Vulnerability Scanning'functionality: 'Web Proxy'description: | Detects the pre-authentica

14 days ago

Aaron BeardsleeCommunity Manager

Two Web Shells, Two Detections: Instrumenting PTC Windchill Against ClopBlog

Where CVE-2026-12569 code actually executes, and what telemetry sees itThe Clop campaign against PTC Windchill produced two structurally different implants. Most coverage treats them as one thing. They are not, they do not generate the same telemetry

350

15 days ago

Aaron BeardsleeCommunity Manager

Securonix Threat Research At Black Hat Arsenal 2026Blog

STR took two tools to Black Hat Arsenal this year: Obscurize, a defensive deception tool that turns malware’s own anti-analysis checks against it, and Inquisitron, a real-time Sysmon viewer and behavioral detection engine for threat hunting. Obscuriz

440

15 days ago

absachinCommunity Manager

Securing Amazon Bedrock: From Logging to Threat Detection with Securonix

TLDR: Amazon Bedrock introduces new attack paths, including RAG poisoning, data exfiltration, agent hijacking, and guardrail tampering. This blog covers the Bedrock telemetry needed to detect these threats and how Securonix uses CloudTrail and Model

1121

15 days ago

doanhnhqNew Member

Securonix On-Prem

Support Dynamic Attribute Values in ThreatQ Create Tasks - Task Title

Currently, the Task Title field in the ThreatQ Create Tasks integration appears to only support static text.We would like to request support for dynamic attribute substitution in the Task Title, allowing attribute values from the associated object to

1530

2 months ago

SimonHuntChief Product Officer

Tips & Tricks

Creating Diamond Models with SAM

Did you know SAM understands Diamond Model Analysis? You can ask Sam to create a report on a violation, something that usually takes a LOT of time to do manually. While working a Violation, Ask Sam: Please prepare a diamond model analysisorFor this

850

Security Analyst 7New Member

Show & Tell

Modify Alert Disposition

Ability to Modify Alert Disposition After ClosureCurrently, if an alert is mistakenly closed as “True Positive” instead of “False Positive,” there is no option available to revert or modify the disposition after closure.Request:It would be very helpf

1761

martel.williamsNew Member

CyberArk API

Greetings,I have an ask from a client to integrate CyberArk API instead of the syslog connector. Currently there is no OOTB parser for it. Would I have to get a cloud collector setup for it?Thank you,Martel

720

makayla.smithNew Member

Phone Number and Bank Account Number Identification

We are pulling data from FS-ISAC into ThreatQ as an event. The issue I am facing here is that we are unable to get the indicators (specifically bank account numbers and phone numbers) ingested into the platform as an indicator.We need to be able to i

5252

Cloudflare WAF logs are not showing in the platform

martel.williamsNew Member

Show & Tell

Hello, We have recently onboarded Cloudflare audit logs and was instructed by a technician that we could also bring in Cloudflare WAF logs on the same data source. It has been enabled on the application, but we are not seeing the WAF logs. Has anyone

2992

4 months ago

fatimaNew Member

Show & Tell

How To Fix Delay in Searchable Period

We noticed a log source searchable period has been showing "16hr in future - 91 days ago" for the past 4-5days. How do we fix this?

2852

4 months ago

martel.williamsNew Member

Reporting feature on HUB

Is there a reporting feature on the HUB to be able to alert when disk space is filling up, when resources are in over use, or when there is an excessive amount of failures going to the UI?

4471

4 months ago

BrillNew Participant