All Detections

TencShell - Tencent API Mocking Web Requests

avatar
Ibrahim Saud@tektrix
updated Jun 20, 2026001

Detects outbound HTTP communication using specific Tencent-themed API impersonation URI structures, which may indicate TencShell activity.

Microsoft Sentinel (KQL)