| splunk |
Icacls Deny Command |
production |
2026-09-01 |
| snort |
ET ATTACK_RESPONSE Grizzly Loader PowerShell Script Inbound |
rev 1 |
2026-08-31 |
| snort |
ET TROJAN Grizzly Loader Config Inbound M2 |
rev 1 |
2026-08-31 |
| snort |
ET TROJAN Grizzly Loader Config Inbound M1 |
rev 1 |
2026-08-31 |
| suricata |
ET MALWARE Grizzly Loader Config Inbound M1 |
rev 1 |
2026-08-31 |
| suricata |
ET MALWARE Grizzly Loader Config Inbound M2 |
rev 1 |
2026-08-31 |
| suricata |
ET ATTACK_RESPONSE Grizzly Loader PowerShell Script Inbound |
rev 1 |
2026-08-31 |
| splunk |
MacOS Osascript Displaying Suspicious User Prompt |
production |
2026-08-31 |
| splunk |
Windows Private Keys Discovery |
production |
2026-08-31 |
| splunk |
Jscript Execution Using Cscript App |
production |
2026-08-31 |
| sigma |
ServiceDll Hijack |
test |
2026-08-31 |
| splunk |
System User Discovery With Whoami |
production |
2026-08-30 |
| splunk |
Network Connection Discovery With Arp |
production |
2026-08-30 |
| snort |
GPL RETIRED Yahoo IM voicechat |
rev 5 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM file transfer request |
rev 10 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM conference logon success |
rev 5 |
2026-08-28 |
| snort |
ET CURRENT_EVENTS Microsoft Phish Landing Page M3 2026-01-22 |
rev 1 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM ping |
rev 6 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM conference offer invitation |
rev 6 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM voicechat |
rev 8 |
2026-08-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thehor .com domain |
rev 1 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM Client Install |
rev 6 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM Unavailable Status |
rev 7 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM successful chat join |
rev 9 |
2026-08-28 |
| snort |
ET RETIRED Yahoo IM successful logon |
rev 11 |
2026-08-28 |
| snort |
ET CURRENT_EVENTS Microsoft Phish Landing Page M2 2026-01-22 |
rev 1 |
2026-08-28 |
| snort |
ET INFO Microsoft Exchange Server MRSProxy NTLM Authentication |
rev 1 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM conference message |
rev 5 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM conference invitation |
rev 5 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM conference watch |
rev 6 |
2026-08-28 |
| snort |
GPL RETIRED Yahoo IM successful chat join |
rev 6 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM file transfer request |
rev 9 |
2026-08-28 |
| suricata |
ET INFO DYNAMIC_DNS HTTP Request to a *.thehor .com domain |
rev 1 |
2026-08-28 |
| suricata |
ET INFO Microsoft Exchange Server MRSProxy NTLM Authentication |
rev 1 |
2026-08-28 |
| suricata |
GPL RETIRED Yahoo IM conference invitation |
rev 6 |
2026-08-28 |
| suricata |
GPL RETIRED Yahoo IM ping |
rev 7 |
2026-08-28 |
| suricata |
ET PHISHING Microsoft Phish Landing Page M3 2026-01-22 |
rev 1 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM successful chat join |
rev 7 |
2026-08-28 |
| suricata |
GPL RETIRED Yahoo IM conference message |
rev 6 |
2026-08-28 |
| suricata |
ET PHISHING Microsoft Phish Landing Page M2 2026-01-22 |
rev 1 |
2026-08-28 |