| suricata |
ET RETIRED Yahoo IM Unavailable Status |
rev 7 |
2026-08-28 |
| suricata |
ET PHISHING Microsoft Phish Landing Page M3 2026-01-22 |
rev 1 |
2026-08-28 |
| suricata |
GPL RETIRED Yahoo IM conference invitation |
rev 6 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM file transfer request |
rev 9 |
2026-08-28 |
| suricata |
ET INFO DYNAMIC_DNS HTTP Request to a *.thehor .com domain |
rev 1 |
2026-08-28 |
| suricata |
GPL RETIRED Yahoo IM conference message |
rev 6 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM successful logon |
rev 8 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM successful chat join |
rev 7 |
2026-08-28 |
| suricata |
ET RETIRED Yahoo IM Client Install |
rev 10 |
2026-08-28 |
| sigma |
Office Autorun Keys Modification |
test |
2026-08-28 |
| sigma |
DNS Query to External Service Interaction Domains |
test |
2026-08-28 |
| snort |
ET INFO HTTP Redirect to Dropbox Hosted PDF |
rev 1 |
2026-08-27 |
| snort |
ET TROJAN GET Request to Minecraft Java Edition Port with Custom X-Header |
rev 4 |
2026-08-27 |
| snort |
ET EXPLOIT Apache Log4j2 Issue #4255 FilteredObjectInputStream Allowlist Bypass via java.rmi.MarshalledObject |
rev 1 |
2026-08-27 |
| suricata |
ET EXPLOIT Apache Log4j2 Issue #4255 FilteredObjectInputStream Allowlist Bypass via java.rmi.MarshalledObject |
rev 1 |
2026-08-27 |
| suricata |
ET HUNTING HTTP Redirect to Dropbox Hosted PDF |
rev 1 |
2026-08-27 |
| suricata |
ET MALWARE GET Request to Minecraft Java Edition Port with Custom X-Header |
rev 4 |
2026-08-27 |
| splunk |
Socat Remote TCP Connection with Local Echo Disabled |
production |
2026-08-27 |
| splunk |
Socat Network Listener Binding an Executable |
production |
2026-08-27 |
| sigma |
Suspicious Volume Shadow Copy Vssapi.dll Load |
test |
2026-08-27 |
| sigma |
Unsigned .node File Loaded |
experimental |
2026-08-27 |
| sigma |
Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load |
test |
2026-08-27 |
| sigma |
Shell Open Registry Keys Manipulation |
test |
2026-08-27 |
| sigma |
CMSTP App Paths Registry Key Modification |
stable |
2026-08-27 |
| sigma |
Uncommon New Firewall Rule Added In Windows Firewall Exception List |
test |
2026-08-27 |
| snort |
ET TROJAN DeviceManager CnC HTTP Requests - Task Polling |
rev 1 |
2026-08-25 |
| snort |
ET TROJAN DeviceManager CnC HTTP Requests - Checkin |
rev 1 |
2026-08-25 |
| snort |
ET TROJAN DeviceManager CnC HTTP Requests - Result Submission |
rev 1 |
2026-08-25 |
| snort |
ET TROJAN DeviceManager CnC DNS Communication - Status Update |
rev 1 |
2026-08-25 |
| suricata |
ET MALWARE DeviceManager CnC DNS Communication - Status Update |
rev 1 |
2026-08-25 |
| suricata |
ET MALWARE DeviceManager CnC HTTP Requests - Task Polling |
rev 1 |
2026-08-25 |
| suricata |
ET MALWARE DeviceManager CnC HTTP Requests - Result Submission |
rev 1 |
2026-08-25 |
| suricata |
ET MALWARE DeviceManager CnC HTTP Requests - Checkin |
rev 1 |
2026-08-25 |
| splunk |
LOLBAS Network Connection On Uncommon Port |
production |
2026-08-24 |
| snort |
ET INFO Tailscale DERP Websocket Upgrade Request |
rev 1 |
2026-08-24 |
| snort |
ET INFO Observed WindowsPowerShell/5.1 User Agent Usage |
rev 1 |
2026-08-24 |
| snort |
ET INFO Observed PowerShell/7 User Agent Usage |
rev 1 |
2026-08-24 |
| snort |
ET INFO GET Request to Minecraft Java Edition Port |
rev 1 |
2026-08-24 |
| snort |
ET INFO Tailscale Control Pane Websocket Upgrade Request |
rev 1 |
2026-08-24 |
| suricata |
ET INFO Observed PowerShell/7 User Agent Usage |
rev 1 |
2026-08-24 |