From a3f6523eabf696d66e20fdd80766bfae95575577 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 23 Oct 2026 17:36:25 +0200 Subject: [PATCH] Bump contentctl.yml and build.yml to 6.10.0 (#4362) --- build.yml | 2 +- contentctl.yml | 2 +- .../detections}/child_processes_of_spoolsv_exe.yml | 4 ++-- .../detections}/detect_html_help_renamed.yml | 4 ++-- .../detections}/detect_mshta_renamed.yml | 4 ++-- .../detections}/detect_renamed_7_zip.yml | 4 ++-- .../detections}/detect_renamed_psexec.yml | 4 ++-- .../detections}/detect_renamed_rclone.yml | 4 ++-- .../detections}/detect_renamed_winrar.yml | 4 ++-- .../detections}/detect_wmi_event_subscription_persistence.yml | 4 ++-- .../detections}/macos___re_opened_applications.yml | 4 ++-- .../suspicious_microsoft_workflow_compiler_rename.yml | 4 ++-- .../detections}/suspicious_msbuild_rename.yml | 4 ++-- .../detections}/windows_lolbas_executed_as_renamed_file.yml | 4 ++-- .../detections}/windows_process_injection_into_notepad.yml | 4 ++-- .../detections}/windows_regsvr32_renamed_binary.yml | 4 ++-- .../detections}/windows_renamed_powershell_execution.yml | 4 ++-- .../detections}/wmi_temporary_event_subscription.yml | 4 ++-- .../deprecated => removed/detections}/xmrig_driver_loaded.yml | 4 ++-- 19 files changed, 36 insertions(+), 36 deletions(-) rename {detections/deprecated => removed/detections}/child_processes_of_spoolsv_exe.yml (98%) rename {detections/deprecated => removed/detections}/detect_html_help_renamed.yml (98%) rename {detections/deprecated => removed/detections}/detect_mshta_renamed.yml (98%) rename {detections/deprecated => removed/detections}/detect_renamed_7_zip.yml (98%) rename {detections/deprecated => removed/detections}/detect_renamed_psexec.yml (98%) rename {detections/deprecated => removed/detections}/detect_renamed_rclone.yml (98%) rename {detections/deprecated => removed/detections}/detect_renamed_winrar.yml (98%) rename {detections/deprecated => removed/detections}/detect_wmi_event_subscription_persistence.yml (98%) rename {detections/deprecated => removed/detections}/macos___re_opened_applications.yml (98%) rename {detections/deprecated => removed/detections}/suspicious_microsoft_workflow_compiler_rename.yml (98%) rename {detections/deprecated => removed/detections}/suspicious_msbuild_rename.yml (98%) rename {detections/deprecated => removed/detections}/windows_lolbas_executed_as_renamed_file.yml (99%) rename {detections/deprecated => removed/detections}/windows_process_injection_into_notepad.yml (98%) rename {detections/deprecated => removed/detections}/windows_regsvr32_renamed_binary.yml (98%) rename {detections/deprecated => removed/detections}/windows_renamed_powershell_execution.yml (98%) rename {detections/deprecated => removed/detections}/wmi_temporary_event_subscription.yml (98%) rename {detections/deprecated => removed/detections}/xmrig_driver_loaded.yml (98%) diff --git a/build.yml b/build.yml index 49791c44a8..8a1b48fffd 100644 --- a/build.yml +++ b/build.yml @@ -9,7 +9,7 @@ author: Splunk Threat Research Team author_email: research@splunk.com content_prefix: ESCU label: ES Content Updates -app_version: 6.9.1 +app_version: 6.10.0 description: Explore the Analytic Stories included with ES Content Updates. id: DA-ESS-ContentUpdate external_app_content: diff --git a/contentctl.yml b/contentctl.yml index e0b3660bf3..9a254d5777 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 6.9.1 + version: 6.10.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU diff --git a/detections/deprecated/child_processes_of_spoolsv_exe.yml b/removed/detections/child_processes_of_spoolsv_exe.yml similarity index 98% rename from detections/deprecated/child_processes_of_spoolsv_exe.yml rename to removed/detections/child_processes_of_spoolsv_exe.yml index 8caf4cabe3..ee9da5ce3e 100644 --- a/detections/deprecated/child_processes_of_spoolsv_exe.yml +++ b/removed/detections/child_processes_of_spoolsv_exe.yml @@ -2,9 +2,9 @@ name: Child Processes of Spoolsv exe id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df version: 12 creation_date: '2020-04-29' -modification_date: '2026-10-02' +modification_date: '2026-10-23' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies child processes spawned by spoolsv.exe, the Print Spooler service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as those associated with CVE-2018-8440, which can lead to privilege escalation. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system. data_source: diff --git a/detections/deprecated/detect_html_help_renamed.yml b/removed/detections/detect_html_help_renamed.yml similarity index 98% rename from detections/deprecated/detect_html_help_renamed.yml rename to removed/detections/detect_html_help_renamed.yml index 6a71fb8028..2dfe7c6d7f 100644 --- a/detections/deprecated/detect_html_help_renamed.yml +++ b/removed/detections/detect_html_help_renamed.yml @@ -2,9 +2,9 @@ name: Detect HTML Help Renamed id: 62fed254-513b-460e-953d-79771493a9f3 version: 15 creation_date: '2021-02-11' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects instances where hh.exe (HTML Help) has been renamed and is executing a Compiled HTML Help (CHM) file. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because attackers can use renamed hh.exe to execute malicious scripts embedded in CHM files, potentially leading to code execution. If confirmed malicious, this technique could allow attackers to run arbitrary scripts, escalate privileges, or persist within the environment, posing a significant security risk. data_source: diff --git a/detections/deprecated/detect_mshta_renamed.yml b/removed/detections/detect_mshta_renamed.yml similarity index 98% rename from detections/deprecated/detect_mshta_renamed.yml rename to removed/detections/detect_mshta_renamed.yml index a18668a17f..d2cfa2c123 100644 --- a/detections/deprecated/detect_mshta_renamed.yml +++ b/removed/detections/detect_mshta_renamed.yml @@ -2,9 +2,9 @@ name: Detect mshta renamed id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 version: 14 creation_date: '2021-01-15' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: diff --git a/detections/deprecated/detect_renamed_7_zip.yml b/removed/detections/detect_renamed_7_zip.yml similarity index 98% rename from detections/deprecated/detect_renamed_7_zip.yml rename to removed/detections/detect_renamed_7_zip.yml index fea1e5e5ce..f0cb4c4675 100644 --- a/detections/deprecated/detect_renamed_7_zip.yml +++ b/removed/detections/detect_renamed_7_zip.yml @@ -2,9 +2,9 @@ name: Detect Renamed 7-Zip id: 4057291a-b8cf-11eb-95fe-acde48001122 version: 13 creation_date: '2021-06-03' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects the usage of a renamed 7-Zip executable using Sysmon data. It leverages the OriginalFileName field to identify instances where the 7-Zip process has been renamed. This activity is significant as attackers often rename legitimate tools to evade detection while staging or exfiltrating data. If confirmed malicious, this behavior could indicate data exfiltration attempts or other unauthorized data manipulation, potentially leading to significant data breaches or loss of sensitive information. Analysts should validate the legitimacy of the 7-Zip executable and investigate parallel processes for further suspicious activities. data_source: diff --git a/detections/deprecated/detect_renamed_psexec.yml b/removed/detections/detect_renamed_psexec.yml similarity index 98% rename from detections/deprecated/detect_renamed_psexec.yml rename to removed/detections/detect_renamed_psexec.yml index 52e1bdf889..c55caecaaa 100644 --- a/detections/deprecated/detect_renamed_psexec.yml +++ b/removed/detections/detect_renamed_psexec.yml @@ -2,9 +2,9 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 version: 18 creation_date: '2021-06-03' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk, Alex Oberkircher, Github Community -status: deprecated +status: removed type: Hunting description: The following analytic identifies instances where `PsExec.exe` has been renamed and executed on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because renaming `PsExec.exe` is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network. data_source: diff --git a/detections/deprecated/detect_renamed_rclone.yml b/removed/detections/detect_renamed_rclone.yml similarity index 98% rename from detections/deprecated/detect_renamed_rclone.yml rename to removed/detections/detect_renamed_rclone.yml index 7e9bccd333..363f4bf74c 100644 --- a/detections/deprecated/detect_renamed_rclone.yml +++ b/removed/detections/detect_renamed_rclone.yml @@ -2,9 +2,9 @@ name: Detect Renamed RClone id: 6dca1124-b3ec-11eb-9328-acde48001122 version: 13 creation_date: '2021-05-13' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems. data_source: diff --git a/detections/deprecated/detect_renamed_winrar.yml b/removed/detections/detect_renamed_winrar.yml similarity index 98% rename from detections/deprecated/detect_renamed_winrar.yml rename to removed/detections/detect_renamed_winrar.yml index 215d1d0a53..b55a454f99 100644 --- a/detections/deprecated/detect_renamed_winrar.yml +++ b/removed/detections/detect_renamed_winrar.yml @@ -2,9 +2,9 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 version: 17 creation_date: '2021-06-03' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic identifies instances where `WinRAR.exe` has been renamed and executed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because renaming executables is a common tactic used by attackers to evade detection. If confirmed malicious, this could indicate an attempt to bypass security controls, potentially leading to unauthorized data extraction or further system compromise. data_source: diff --git a/detections/deprecated/detect_wmi_event_subscription_persistence.yml b/removed/detections/detect_wmi_event_subscription_persistence.yml similarity index 98% rename from detections/deprecated/detect_wmi_event_subscription_persistence.yml rename to removed/detections/detect_wmi_event_subscription_persistence.yml index 2d746625cb..946602af77 100644 --- a/detections/deprecated/detect_wmi_event_subscription_persistence.yml +++ b/removed/detections/detect_wmi_event_subscription_persistence.yml @@ -2,9 +2,9 @@ name: Detect WMI Event Subscription Persistence id: 01d9a0c2-cece-11eb-ab46-acde48001122 version: 13 creation_date: '2021-06-16' -modification_date: '2026-10-05' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment. data_source: diff --git a/detections/deprecated/macos___re_opened_applications.yml b/removed/detections/macos___re_opened_applications.yml similarity index 98% rename from detections/deprecated/macos___re_opened_applications.yml rename to removed/detections/macos___re_opened_applications.yml index 708d18b627..c0b9b210fb 100644 --- a/detections/deprecated/macos___re_opened_applications.yml +++ b/removed/detections/macos___re_opened_applications.yml @@ -2,9 +2,9 @@ name: MacOS - Re-opened Applications id: 40bb64f9-f619-4e3d-8732-328d40377c4b version: 9 creation_date: '2020-04-29' -modification_date: '2026-09-18' +modification_date: '2026-10-23' author: Jamie Windley, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies processes referencing plist files that determine which applications are re-opened when a user reboots their MacOS machine. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes related to "com.apple.loginwindow." This activity is significant because it can indicate attempts to persist across reboots, a common tactic used by attackers to maintain access. If confirmed malicious, this could allow an attacker to execute code or maintain persistence on the affected system, potentially leading to further compromise. data_source: diff --git a/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml b/removed/detections/suspicious_microsoft_workflow_compiler_rename.yml similarity index 98% rename from detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml rename to removed/detections/suspicious_microsoft_workflow_compiler_rename.yml index ec137b5b28..a46d66aa49 100644 --- a/detections/deprecated/suspicious_microsoft_workflow_compiler_rename.yml +++ b/removed/detections/suspicious_microsoft_workflow_compiler_rename.yml @@ -2,9 +2,9 @@ name: Suspicious microsoft workflow compiler rename id: f0db4464-55d9-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-19' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: diff --git a/detections/deprecated/suspicious_msbuild_rename.yml b/removed/detections/suspicious_msbuild_rename.yml similarity index 98% rename from detections/deprecated/suspicious_msbuild_rename.yml rename to removed/detections/suspicious_msbuild_rename.yml index 4fb2bbb641..cafc587df4 100644 --- a/detections/deprecated/suspicious_msbuild_rename.yml +++ b/removed/detections/suspicious_msbuild_rename.yml @@ -2,9 +2,9 @@ name: Suspicious MSBuild Rename id: 4006adac-5937-11eb-ae93-0242ac130002 version: 15 creation_date: '2021-01-15' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Hunting description: The following analytic detects the execution of renamed instances of msbuild.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names within the Endpoint data model. This activity is significant because msbuild.exe is a legitimate tool often abused by attackers to execute malicious code while evading detection. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. data_source: diff --git a/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml b/removed/detections/windows_lolbas_executed_as_renamed_file.yml similarity index 99% rename from detections/deprecated/windows_lolbas_executed_as_renamed_file.yml rename to removed/detections/windows_lolbas_executed_as_renamed_file.yml index 94d1538a1a..3c47b9bae6 100644 --- a/detections/deprecated/windows_lolbas_executed_as_renamed_file.yml +++ b/removed/detections/windows_lolbas_executed_as_renamed_file.yml @@ -2,9 +2,9 @@ name: Windows LOLBAS Executed As Renamed File id: fd496996-7d9e-4894-8d40-bb85b6192dc6 version: 11 creation_date: '2024-05-03' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Steven Dick -status: deprecated +status: removed type: TTP description: The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute. Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. data_source: diff --git a/detections/deprecated/windows_process_injection_into_notepad.yml b/removed/detections/windows_process_injection_into_notepad.yml similarity index 98% rename from detections/deprecated/windows_process_injection_into_notepad.yml rename to removed/detections/windows_process_injection_into_notepad.yml index d4869ca37b..38fc296257 100644 --- a/detections/deprecated/windows_process_injection_into_notepad.yml +++ b/removed/detections/windows_process_injection_into_notepad.yml @@ -2,9 +2,9 @@ name: Windows Process Injection into Notepad id: b8340d0f-ba48-4391-bea7-9e793c5aae36 version: 14 creation_date: '2023-02-24' -modification_date: '2026-09-21' +modification_date: '2026-10-23' author: Michael Haag, Splunk -status: deprecated +status: removed type: Anomaly description: The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment. data_source: diff --git a/detections/deprecated/windows_regsvr32_renamed_binary.yml b/removed/detections/windows_regsvr32_renamed_binary.yml similarity index 98% rename from detections/deprecated/windows_regsvr32_renamed_binary.yml rename to removed/detections/windows_regsvr32_renamed_binary.yml index 4d6940c412..3ae143e820 100644 --- a/detections/deprecated/windows_regsvr32_renamed_binary.yml +++ b/removed/detections/windows_regsvr32_renamed_binary.yml @@ -2,9 +2,9 @@ name: Windows Regsvr32 Renamed Binary id: 7349a9e9-3cf6-4171-bb0c-75607a8dcd1a version: 14 creation_date: '2022-10-27' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies instances where the regsvr32.exe binary has been renamed and executed. This detection leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original filename metadata. Renaming regsvr32.exe is significant as it can be an evasion technique used by attackers to bypass security controls. If confirmed malicious, this activity could allow an attacker to execute arbitrary DLLs, potentially leading to code execution, privilege escalation, or persistence within the environment. data_source: diff --git a/detections/deprecated/windows_renamed_powershell_execution.yml b/removed/detections/windows_renamed_powershell_execution.yml similarity index 98% rename from detections/deprecated/windows_renamed_powershell_execution.yml rename to removed/detections/windows_renamed_powershell_execution.yml index dbb8ef8e18..4868145665 100644 --- a/detections/deprecated/windows_renamed_powershell_execution.yml +++ b/removed/detections/windows_renamed_powershell_execution.yml @@ -2,9 +2,9 @@ name: Windows Renamed Powershell Execution id: c08014de-cc5a-42de-9775-76ecd5b37bbd version: 9 creation_date: '2022-10-27' -modification_date: '2026-09-23' +modification_date: '2026-10-23' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk -status: deprecated +status: removed type: TTP description: The following analytic identifies instances where the PowerShell executable has been renamed and executed under an alternate filename. This behavior is commonly associated with attempts to evade security controls or bypass logging mechanisms that monitor standard PowerShell usage. While rare in legitimate environments, renamed PowerShell binaries are frequently observed in malicious campaigns leveraging Living-off-the-Land Binaries (LOLBins) and fileless malware techniques. This detection flags executions of PowerShell where the process name does not match the default powershell.exe or pwsh.exe, especially when invoked from unusual paths or accompanied by suspicious command-line arguments. data_source: diff --git a/detections/deprecated/wmi_temporary_event_subscription.yml b/removed/detections/wmi_temporary_event_subscription.yml similarity index 98% rename from detections/deprecated/wmi_temporary_event_subscription.yml rename to removed/detections/wmi_temporary_event_subscription.yml index abe30ff297..b5d57b8395 100644 --- a/detections/deprecated/wmi_temporary_event_subscription.yml +++ b/removed/detections/wmi_temporary_event_subscription.yml @@ -2,9 +2,9 @@ name: WMI Temporary Event Subscription id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 version: 11 creation_date: '2020-04-29' -modification_date: '2026-10-05' +modification_date: '2026-10-23' author: Rico Valdez, Splunk -status: deprecated +status: removed type: TTP description: The following analytic detects the creation of WMI temporary event subscriptions. It leverages Windows Event Logs, specifically EventCode 5860, to identify these activities. This detection is significant because attackers often use WMI to execute commands, gather information, or maintain persistence within a compromised system. If confirmed malicious, this activity could allow an attacker to execute arbitrary code, escalate privileges, or persist in the environment. Analysts should review the specific WMI queries and assess their intent, considering potential false positives from legitimate administrative tasks. data_source: [] diff --git a/detections/deprecated/xmrig_driver_loaded.yml b/removed/detections/xmrig_driver_loaded.yml similarity index 98% rename from detections/deprecated/xmrig_driver_loaded.yml rename to removed/detections/xmrig_driver_loaded.yml index 325f1d027d..2b5b6ecde4 100644 --- a/detections/deprecated/xmrig_driver_loaded.yml +++ b/removed/detections/xmrig_driver_loaded.yml @@ -2,9 +2,9 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 version: 11 creation_date: '2021-05-07' -modification_date: '2026-09-08' +modification_date: '2026-10-23' author: Teoderick Contreras, Splunk -status: deprecated +status: removed type: TTP description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. data_source: