DShield Sensors Detect Winter Spike in Malicious File Uploads

The article by Guy Bruneau analyzes the data collected over the past year from DShield sensors, detailing the types of files uploaded and their trends. It reveals that file uploads peaked during the winter months (December 2025 - February 2026) and decreased afterward. The analysis categorized file types into eight categories, including ELF, Shell script, and Powershell, using two ES|QL queries to summarize the activity.

The data was visualized using Kibana, showing both monthly trends and daily file uploads, emphasizing the importance of monitoring for malware and file activity within DShield's SIEM.