title: Threat Event Detection
id: 56287074-cbcd-5d6a-88cc-c7b70db1058a
custom_id: wf-mal-007
status: stable
level: high
description: |
    Detects generic threat events identified by security tools forwarded
    through WitFoo's ingestion pipeline. Covers threats not classified into
    more specific categories.
author: WitFoo
date: 2026-02-21
tags:
    - attack.execution
    - attack.t1204
references:
    - https://attack.mitre.org/techniques/T1204/
logsource:
    product: witfoo
    service: artifact-exporter
detection:
    selection:
        messageType: "threat_event"
    condition: selection
fields:
    - clientIP
    - serverIP
    - ruleName
    - ruleCategory
    - program
    - matchedLeadRules
    - severityLabel
falsepositives:
    - Low-severity threat events from noisy security tools
    - Informational threat intelligence alerts