| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M9 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M8 |
rev 1 |
2026-08-13 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Javascript Loader URI to *.top domain M4 |
rev 1 |
2026-08-13 |
| elastic |
Deprecated - M365 Security Compliance Email Reported by User as Malware or Phish |
deprecated |
2026-08-13 |
| sigma |
New User Account Creation Attempt Via ADSI in CommandLine |
experimental |
2026-08-13 |
| sigma |
New User Account Creation Attempt Via ADSI |
experimental |
2026-08-13 |
| splunk |
ESXi Encryption Settings Modified |
production |
2026-08-12 |
| splunk |
Linux Possible Append Command To Profile Config File |
production |
2026-08-12 |
| splunk |
Ping Sleep Batch Command |
production |
2026-08-11 |
| splunk |
Windows Set Account Password Policy To Unlimited Via Net |
production |
2026-08-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.robertschulze .name domain |
rev 1 |
2026-08-09 |
| snort |
ET CURRENT_EVENTS TA2730 Javascript Request 2026-08-06 |
rev 1 |
2026-08-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.longmusic .com domain |
rev 1 |
2026-08-07 |
| suricata |
ET PHISHING TA2730 Javascript Request 2026-08-06 |
rev 1 |
2026-08-07 |
| suricata |
ET PHISHING Generic AiTM Fingerprint Exfil |
rev 1 |
2026-08-07 |
| sigma |
Potentially Suspicious Mofcomp Execution |
test |
2026-08-06 |
| splunk |
Executable File Written in Administrative SMB Share |
production |
2026-08-05 |
| splunk |
Network Share Discovery Via Dir Command |
production |
2026-08-05 |
| splunk |
High Frequency Copy Of Files In Network Share |
production |
2026-08-05 |
| splunk |
Windows Disable Shutdown Button Through Registry |
production |
2026-08-05 |
| splunk |
Windows User Discovery Via Net |
production |
2026-08-05 |
| splunk |
Windows Registry Dotnet ETW Disabled Via ENV Variable |
production |
2026-08-05 |
| snort |
ET WEB_SPECIFIC_APPS Red Hat Keycloak Unauthenticated Server-side Request Forgery in OIDC Dynamic Client Registration |
rev 1 |
2026-08-04 |
| suricata |
ET WEB_SPECIFIC_APPS Red Hat Keycloak Unauthenticated Server-side Request Forgery in OIDC Dynamic Client Registration |
rev 1 |
2026-08-04 |
| elastic |
Potential CVE-2025-41244 vmtoolsd LPE Exploitation Attempt |
deprecated |
2026-08-03 |
| snort |
ET INFO HTTP 300-Series Redirect to file URI attempt |
rev 2 |
2026-07-31 |
| snort |
ET WEB_CLIENT PROPFIND Flowbit Set |
rev 6 |
2026-07-31 |
| suricata |
ET HUNTING HTTP 300-Series Redirect to file URI attempt |
rev 8 |
2026-07-31 |
| suricata |
ET WEB_CLIENT PROPFIND Flowbit Set |
rev 8 |
2026-07-31 |
| snort |
ET RETIRED Possible 2015-7547 Malformed Server response |
rev 2 |
2026-07-30 |
| suricata |
ET RETIRED Possible 2015-7547 Malformed Server response |
rev 2 |
2026-07-30 |
| splunk |
Windows Suspicious Child Process of Consent.EXE |
production |
2026-07-30 |
| splunk |
Windows Powershell Commands from DNS TXT |
production |
2026-07-30 |
| splunk |
Windows Dir Piped to Findstr Activity |
production |
2026-07-30 |