| snort |
ET INFO Tailscale Control Pane in TLS SNI |
rev 1 |
2026-08-20 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M41 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M48 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M46 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M41 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M38 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M40 |
rev 1 |
2026-08-20 |
| suricata |
ET INFO Tailscale DERP Relay Server in TLS SNI |
rev 1 |
2026-08-20 |
| suricata |
ET INFO Tailscale Control Pane in DNS Query |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M36 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M39 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M37 |
rev 1 |
2026-08-20 |
| suricata |
ET INFO Tailscle DERP Relay Server in DNS Query |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M50 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M43 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M33 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M44 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M35 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M47 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M42 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M31 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M32 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M34 |
rev 1 |
2026-08-20 |
| suricata |
ET INFO Tailscale Control Pane in TLS SNI |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M45 |
rev 1 |
2026-08-20 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M49 |
rev 1 |
2026-08-20 |
| splunk |
Windows SCCM Adsource DLL Was Planted In SMS Provider Directory |
production |
2026-08-20 |
| splunk |
Windows Phantom DLL Created on Disk |
production |
2026-08-20 |
| sigma |
Added Credentials to Existing Application |
test |
2026-08-20 |
| splunk |
Windows Cloud Sensitive File Read Access By Uncommon Process |
production |
2026-08-19 |
| splunk |
Windows Defender MpClient.dll Loaded by Non-Defender Process |
production |
2026-08-19 |
| elastic |
Deprecated - Adobe Hijack Persistence |
deprecated |
2026-08-19 |
| elastic |
Deprecated - SUNBURST Command and Control Activity |
deprecated |
2026-08-19 |
| elastic |
Deprecated - Potential PowerShell Obfuscated Script |
deprecated |
2026-08-19 |
| elastic |
Deprecated - Encoded Executable Stored in the Registry |
deprecated |
2026-08-19 |
| elastic |
Deprecated - Suspicious PrintSpooler Service Executable File Creation |
deprecated |
2026-08-19 |
| sigma |
Linux Webshell Indicators |
test |
2026-08-19 |
| sigma |
PowerShell AppLocker Policy Discovery Via Get-AppLockerPolicy |
experimental |
2026-08-19 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M26 |
rev 1 |
2026-08-18 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Javascript Loader URI to *.top domain M28 |
rev 1 |
2026-08-18 |