Enforcement
Accepted
Attempts for this ban: 0
Last attempt: never recorded
Accepted at: 2026-09-25T22:40:03.011740+00:00
Historical attempts were not recorded.
Acceptance records a successful command response. CrowdSec state has not been checked for drift.
Reasons
- High severity exploit activity was observed, but only from a single node.
- Multiple stages of an attack chain were observed within a short time window.
- Observed behavior consistent with post-compromise activity, such as backdoors, webshells, or lateral movement.
- High-confidence indicators of post-exploitation activity were detected.
MITRE ATT&CK Mappings
- Tactics: Command and Control / Persistence, Initial Access, Reconnaissance
- Techniques: T1059, T1105, T1190, T1595
Evidence
- Last observed: unknown
- Last persisted: unknown
- Nodes observed: 1
- Severity: CRITICAL
- TTL remaining: 17h 15m