Detected presence of files containing domains used for intercepting and inspecting HTTP requests. (x9)

Detected presence of malicious files through analyst-vetted file reputation. (x5)

Detected presence of known software supply chain attack artifacts. (x5)

Detected presence of files containing URLs that use non-standard ports. (x3)

Detected presence of placeholder credentials within network protocol strings. (x3)

Detected presence of commonly distributed sensitive data. (x3)