Rule Library

Sigma Rules

1,478 rules found for "execution"

3,707Total
3,116Detection
451Emerging
137Hunting
Emerging Threathightest

PaperCut MF/NG Exploitation Related Indicators

Detects exploitation indicators related to PaperCut MF/NG Exploitation

WindowsProcess Creation
TA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Tue Apr 252023
Emerging Threathightest

PaperCut MF/NG Potential Exploitation

Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

WindowsProcess Creation
TA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)+1Thu Apr 202023
Emerging Threathightest

Peach Sandstorm APT Process Activity Indicators

Detects process creation activity related to Peach Sandstorm APT

WindowsProcess Creation
TA0002 · Executiondetection.emerging-threats
X__Junior (Nextron Systems)Mon Jan 152023
Emerging Threathightest

UNC4841 - Email Exfiltration File Pattern

Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

LinuxFile Event
TA0002 · ExecutionTA0003 · PersistenceTA0005 · Defense Evasiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threathightest

UNC4841 - Barracuda ESG Exploitation Indicators

Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

LinuxFile Event
TA0002 · ExecutionTA0003 · PersistenceTA0005 · Defense Evasiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threathightest

UNC4841 - SSL Certificate Exfiltration Via Openssl

Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

LinuxProcess Creation
TA0005 · Defense EvasionT1140 · Deobfuscate/Decode Files or Informationdetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threathightest

UNC4841 - Download Compressed Files From Temp.sh Using Wget

Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

LinuxProcess Creation
TA0005 · Defense EvasionT1140 · Deobfuscate/Decode Files or Informationdetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threathightest

UNC4841 - Download Tar File From Untrusted Direct IP Via Wget

Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

LinuxProcess Creation
TA0005 · Defense EvasionT1140 · Deobfuscate/Decode Files or Informationdetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threatcriticaltest

UNC4841 - Potential SEASPY Execution

Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

LinuxProcess Creation
TA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Fri Jun 162023
Emerging Threathightest

Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.

LinuxProcess Creation
TA0002 · Executioncve.2024-3094detection.emerging-threats
Arnim Rupp+2Mon Apr 012024
Emerging Threatmediumtest

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation

Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

paloaltoFile Eventglobalprotect
TA0002 · Executioncve.2024-3400detection.emerging-threats
Andreas Braathen (mnemonic.io)Thu Apr 252024
Emerging Threathightest

Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group

Detects execution of the "net.exe" command in order to add a group named "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

WindowsProcess Creation
TA0002 · Executioncve.2024-37085detection.emerging-threats
François HubautMon Jul 292024
Emerging Threathightest

Potential Exploitation of CVE-2024-37085 - Suspicious ESX Admins Group Activity

Detects any creation or modification to a windows domain group with the name "ESX Admins". This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor. VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.

Windowssecurity
TA0002 · Executioncve.2024-37085detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Tue Jul 302024
Emerging Threathighexperimental

CVE-2024-50623 Exploitation Attempt - Cleo

Detects exploitation attempt of Cleo's CVE-2024-50623 by looking for a "cmd.exe" process spawning from the Celo software suite with suspicious Powershell commandline.

WindowsProcess Creation
TA0001 · Initial AccessTA0002 · ExecutionT1190 · Exploit Public-Facing Applicationcve.2024-50623+1
Tanner Filip+3Mon Dec 092024
Emerging Threatmediumtest

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

WindowsFile Event
TA0002 · ExecutionT1059 · Command and Scripting Interpreterdetection.emerging-threats
Tomasz Dyduch+1Fri May 312024
Emerging Threathighexperimental

File Creation Related To RAT Clients

File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.

WindowsFile Event
TA0002 · Executiondetection.emerging-threats
Joseliyo SanchezThu Dec 192024
Emerging Threatmediumtest

Potential KamiKakaBot Activity - Lure Document Execution

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

WindowsProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting Interpreterdetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)+1Fri Mar 222024
Emerging Threathightest

Kapeka Backdoor Loaded Via Rundll32.EXE

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

WindowsImage Load (DLL)
TA0002 · ExecutionT1204.002 · Malicious FileTA0005 · Defense EvasionT1218.011 · Rundll32+1
Swachchhanda Shrawan PoudelWed Jul 032024
Emerging Threathightest

Kapeka Backdoor Persistence Activity

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0002 · ExecutionTA0003 · PersistenceT1053.005 · Scheduled Task+1
Swachchhanda Shrawan PoudelWed Jul 032024
Emerging Threathightest

Kapeka Backdoor Execution Via RunDLL32.EXE

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

WindowsProcess Creation
TA0005 · Defense EvasionT1218.011 · Rundll32detection.emerging-threats
Swachchhanda Shrawan Poudel+1Wed Jul 032024
Emerging Threathightest

Kapeka Backdoor Scheduled Task Creation

Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Windowssecurity
TA0002 · ExecutionTA0004 · Privilege EscalationTA0003 · PersistenceT1053.005 · Scheduled Task+1
Swachchhanda Shrawan PoudelWed Jul 032024
Emerging Threathighexperimental

Lummac Stealer Activity - Execution Of More.com And Vbc.exe

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0005 · Defense EvasionT1055 · Process Injectiondetection.emerging-threats
Joseliyo SanchezThu Dec 192024
Emerging Threathightest

Potential Raspberry Robin CPL Execution Activity

Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function. This behavior was observed in multiple Raspberry-Robin variants.

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · ExecutionT1218.011 · Rundll32detection.emerging-threats
Swachchhanda Shrawan PoudelThu Mar 072024
Emerging Threatmediumtest

Potential APT FIN7 Exploitation Activity

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

WindowsProcess Creation
TA0002 · ExecutionT1059.001 · PowerShellT1059.003 · Windows Command Shelldetection.emerging-threats
Alex WalstonMon Jul 292024
Emerging Threathighexperimental

Forest Blizzard APT - Process Creation Activity

Detects the execution of specific processes and command line combination. These were seen being created by Forest Blizzard as described by MSFT.

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · Executiondetection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Tue Apr 232024
Emerging Threathighexperimental

Potential Exploitation of GoAnywhere MFT Vulnerability

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

WindowsProcess Creation
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0002 · ExecutionT1059.001 · PowerShell+4
MSFT+1Tue Oct 072025
Emerging Threathighexperimental

Suspicious Process Spawned by CentreStack Portal AppPool

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

WindowsProcess Creation
TA0003 · PersistenceTA0002 · ExecutionT1059.003 · Windows Command ShellT1505.003 · Web Shell+2
Jason Rathbun (Blackpoint Cyber)Thu Apr 172025
Emerging Threatmediumexperimental

Suspicious CrushFTP Child Process

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

WindowsProcess Creation
TA0001 · Initial AccessTA0002 · ExecutionT1059.001 · PowerShellT1059.003 · Windows Command Shell+3
Craig Sweeney+6Thu Apr 102025
Emerging Threatmediumexperimental

Potential SAP NetWeaver Webshell Creation - Linux

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

LinuxFile Event
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0003 · Persistence+3
Elastic Security+1Mon Apr 282025
Emerging Threatmediumexperimental

Potential SAP NetWeaver Webshell Creation

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

WindowsFile Event
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0003 · Persistence+3
Elastic Security+1Mon Apr 282025
Emerging Threatmediumexperimental

Suspicious Child Process of SAP NetWeaver - Linux

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

LinuxProcess Creation
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0003 · Persistence+3
Elastic Security+1Mon Apr 282025
Emerging Threatmediumexperimental

Suspicious Child Process of SAP NetWeaver

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

WindowsProcess Creation
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0003 · Persistence+3
Elastic Security+1Mon Apr 282025
Emerging Threathighexperimental

Potential SAP NetViewer Webshell Command Execution

Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. This rule is created to detect exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell.

Web Server Log
TA0003 · PersistenceT1505.003 · Web ShellTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Swachchhanda Shrawan Poudel (Nextron Systems)Wed May 142025
Emerging Threathighexperimental

Potential Java WebShell Upload in SAP NetViewer Server

Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.

Web Server Log
TA0003 · PersistenceT1505.003 · Web Shelldetection.emerging-threatscve.2025-31324
Swachchhanda Shrawan Poudel (Nextron Systems)Wed May 142025
Emerging Threathighexperimental

Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation

Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.

LinuxFile Event
TA0004 · Privilege EscalationT1068 · Exploitation for Privilege Escalationcve.2025-32463detection.emerging-threats
Swachchhanda Shrawn Poudel (Nextron Systems)Thu Oct 022025
Emerging Threathighexperimental

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.

WindowsImage Load (DLL)
TA0011 · Command and ControlTA0002 · ExecutionTA0005 · Defense EvasionT1218 · System Binary Proxy Execution+4
Swachchhanda Shrawan Poudel (Nextron Systems)Fri Jun 132025
Emerging Threathighexperimental

Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.

WindowsProcess Access
TA0011 · Command and ControlTA0002 · ExecutionTA0005 · Defense EvasionT1218 · System Binary Proxy Execution+4
Swachchhanda Shrawan Poudel (Nextron Systems)Fri Jun 132025
Emerging Threathighexperimental

Potential Exploitation of RCE Vulnerability CVE-2025-33053

Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.

WindowsProcess Creation
TA0011 · Command and ControlTA0002 · ExecutionTA0005 · Defense EvasionT1218 · System Binary Proxy Execution+4
Swachchhanda Shrawan Poudel (Nextron Systems)Fri Jun 132025
Emerging Threathighexperimental

Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationTA0002 · ExecutionT1203 · Exploitation for Client Execution+3
Swachchhanda Shrawan Poudel (Nextron Systems)Tue May 202025
Emerging Threatcriticalexperimental

Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create

Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

WindowsFile Event
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
Emerging Threathighexperimental

Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators

Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

WindowsProcess Creation
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
Emerging Threatmediumexperimental

SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS

Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs. CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.

Web Server Log
TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationcve.2025-53770detection.emerging-threats
Swachchhanda Shrawan Poudel (Nextron Systems)Mon Jul 212025
Emerging Threathighexperimental

Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

WindowsProcess Creation
TA0004 · Privilege EscalationTA0001 · Initial AccessTA0002 · ExecutionT1059.001 · PowerShell+5
Nisarg SutharFri Aug 012025
Emerging Threathighexperimental

Linux Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

LinuxProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Swachchhanda Shrawan Poudel (Nextron Systems)+1Fri Dec 052025
Emerging Threathighexperimental

Windows Suspicious Child Process from Node.js - React2Shell

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

WindowsProcess Creation
TA0002 · ExecutionT1059 · Command and Scripting InterpreterTA0001 · Initial AccessT1190 · Exploit Public-Facing Application+2
Swachchhanda Shrawan Poudel (Nextron Systems)+1Fri Dec 052025
Emerging Threathighexperimental

Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process

Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe. This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.

WindowsProcess Creation
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationT1203 · Exploitation for Client Execution+2
Huntress Labs+1Fri Oct 312025
Emerging Threathighexperimental

Exploitation Activity of CVE-2025-59287 - WSUS Deserialization

Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS.

Windowsapplication
TA0002 · ExecutionTA0001 · Initial AccessT1190 · Exploit Public-Facing ApplicationT1203 · Exploitation for Client Execution+2
Swachchhanda Shrawan Poudel (Nextron Systems)Fri Oct 312025
Emerging Threathighexperimental

Atomic MacOS Stealer - FileGrabber Activity

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

macOSProcess Creation
TA0002 · ExecutionT1059.002 · AppleScriptdetection.emerging-threats
Jason Phang Vern - Onn+1Sat Nov 222025