AlphaSOC

Got Splunk? Our latest release adds MITRE ATT&CK mapping and enables teams to identify both known and unknown emerging threats. Use Network Behavior Analytics for Splunk to instantly process your network telemetry and solve 70+ detection use cases >> splunkbase.splunk.com/app/40…

Download the AlphaSOC MITRE ATT&CK Navigator layer and explore the tactics and techniques covered by our in-built managed detections. Read more here >> docs.alphasoc.com/detections…

Sansec reports a Magento skimmer campaign exploiting two CVEs to inject loader scripts into CMS blocks across 953 stores, fingerprinting browsers to evade scanners. AlphaSOC flags these malware and C2 patterns to protect customers. Read more here >> sansec.io/research/magento-c…

We track the most dangerous effective top-level domains (eTLDs) online by processing the indicators within our platform each month. Our feed is updated daily, and you can use it to instantly block traffic to statistically bad domains >> feeds.alphasoc.net/bad-etlds…

Sending audit logs and telemetry to Cribl Stream? You can process those raw events using AlphaSOC via our native integration for Cribl and forward the findings in OCSF format on to your SIEM or Data Lake to reduce your costs. Read more here >> alphasoc.com/cribl

Our engine highlights threats across GitHub and the other applications that your business relies on (e.g., 1Password, Jira, Okta, and Slack). AlphaSOC is free to evaluate for 30 days without restriction or obligation. Learn more here >> alphasoc.com

Security teams can use our MCP integration for Claude, Cursor, and other AI tools to perform real-time reputation scoring against our threat intelligence platform and classifiers. Get started here >> docs.alphasoc.com/mcp_server…

Forescout reports ROMULUS, a multi-payload ClickFix platform dropping DLL sideloading packages and LegionLoader via PowerShell across six active servers. AlphaSOC flags these malware delivery and C2 traffic patterns to protect customers. Read more here >> forescout.com/blog/romulus-a…

Need unparalleled visibility into your Azure environment and cloud workloads? AlphaSOC highlights privilege escalation, compromised workloads, hacked accounts, and data exfiltration. Evaluate our analytics engine for free >> alphasoc.com/azure

Facing high Splunk licensing costs? You can run searches against the AlphaSOC OCSF Data Lake to drive investigations and threat hunting without having to index terabytes of low-value, raw logs. Learn more >> docs.alphasoc.com/platform_i…

We process network telemetry to cover 70+ out-of-the-box detection use cases and highlight patterns including spear phishing, impersonation attacks, anonymizing circuit traffic (e.g. Tor and I2P) and cryptomining pool participation. Read more >> docs.alphasoc.com/detections…

Want to flag anomalies within your AWS environment and overlay them with MITRE ATT&CK? We have extended our analytics engine to process CloudTrail logs and highlight 400+ threats. Here's a full list of detection use cases >> docs.alphasoc.com/detections…

Huntress reports a ClickFix campaign delivering a DLL-sideloaded RAT through malicious ChatGPT Custom GPTs promoted in Google ads. AlphaSOC flags these malware delivery and C2 traffic patterns to protect customers. Read more here >> huntress.com/blog/chatgpt-cu…

Want to check whether your threat detection stack can flag C2 beacons, anonymizing circuit traffic, cryptomining, DNS tunneling, and other threats? Use our free, open source adversary simulation tool to instantly evaluate your coverage >> github.com/alphasoc/flightsi…

Using Sigma rules for detection and hunting? Process your EDR telemetry (e.g., Defender for Endpoint, CrowdStrike Falcon, and SentinelOne) with AlphaSOC and deploy both community and custom Sigma detections outside of your SIEM. Read more here >> docs.alphasoc.com/detections…

Our Analytics Engine supports detections across endpoints, cloud workloads, and SaaS applications! Process your CrowdStrike FDR telemetry and logs from AWS, GitHub, Slack, Okta, and other platforms to hunt threats. Dig into the docs here >> docs.alphasoc.com/

We have many new SaaS detections for GitHub, Okta, and Slack. Process your SaaS audit logs with the AlphaSOC Analytics Engine to hunt threats and even deploy your own custom Sigma rules. Read more here >> docs.alphasoc.com/detections…

Unit 42 reports Blinder Tunnel, an Iranian campaign targeting Iraq's critical infrastructure via spearphishing with ShelbyLoader V2 and GitHub-based C2. AlphaSOC flags these malware delivery and C2 traffic patterns to protect customers. Read more here >> unit42.paloaltonetworks.com/…

Uncover compromised cloud workloads, privilege escalation, and data exfiltration in your AWS CloudTrail, EKS, RDS, VPC flow, and Route 53 telemetry with our patented analytics engine. Learn more here >> alphasoc.com/aws

Lookalike domains (aka homoglyphs) are commonly used by threat actors in spearphishing campaigns. AlphaSOC flags these patterns in real-time to alert security teams and protect customers.