| snort |
ET TROJAN JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| snort |
ET TROJAN JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE JS ZimReaper Zimbra Mailbox Archive Export |
rev 1 |
2026-07-21 |
| suricata |
ET SCAN Zimbra Collaboration Global Address List Bulk Enumeration |
rev 1 |
2026-07-21 |
| suricata |
ET MALWARE JS SpyPress C2 Beacon |
rev 1 |
2026-07-21 |
| snort |
ET INFO NGrok Skip Browser Warning Header |
rev 1 |
2026-07-20 |
| suricata |
ET INFO NGrok Skip Browser Warning Header |
rev 1 |
2026-07-20 |
| splunk |
Registry Keys Used For Persistence |
production |
2026-07-20 |
| splunk |
Recon AVProduct Through Pwh or WMI |
production |
2026-07-20 |
| splunk |
Windows RDP Cache File Deletion |
production |
2026-07-20 |
| splunk |
Windows Rdp AutomaticDestinations Deletion |
production |
2026-07-20 |
| splunk |
Windows MSI Rollback Script Deleted By Non-Msiexec Process |
production |
2026-07-20 |
| splunk |
Wscript Or Cscript Suspicious Child Process |
production |
2026-07-20 |
| splunk |
Windows Curl Download to Suspicious Path |
production |
2026-07-20 |
| splunk |
Windows Mark Of The Web Bypass |
production |
2026-07-20 |
| splunk |
Detect MSHTA Url in Command Line |
production |
2026-07-20 |
| splunk |
Windows Suspicious Defender Update Activity in INetCache |
production |
2026-07-20 |
| splunk |
Windows Boot or Logon Autostart Execution In Startup Folder |
production |
2026-07-20 |
| splunk |
Windows DNS Query Request by Telegram Bot API |
production |
2026-07-20 |
| splunk |
Set Default PowerShell Execution Policy To Unrestricted or Bypass |
production |
2026-07-20 |
| splunk |
Domain Controller Discovery with Nltest |
production |
2026-07-20 |
| splunk |
Windows Gather Victim Network Info Through Ip Check Web Services |
production |
2026-07-20 |
| splunk |
Malicious PowerShell Process - Execution Policy Bypass |
production |
2026-07-20 |
| splunk |
Windows Mshta Execution In Registry |
production |
2026-07-20 |
| splunk |
Windows PowerShell ScheduleTask |
production |
2026-07-20 |
| sigma |
Rundll32 UNC Path Execution |
test |
2026-07-20 |
| sigma |
WordPress Wp2shell Webshell Plugin Access |
experimental |
2026-07-19 |
| sigma |
WordPress Wp2shell Exploitation Tool User-Agent |
experimental |
2026-07-19 |
| sigma |
WordPress Wp2shell REST Batch Endpoint Exploitation |
experimental |
2026-07-19 |
| splunk |
Linux PF_ALG Registration Outside of Boot Window |
production |
2026-07-17 |
| splunk |
Linux Suspicious Child Process of PostgreSQL |
production |
2026-07-17 |
| splunk |
Linux Binary Launched Process with Null Argv |
production |
2026-07-17 |
| suricata |
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query |
rev 3 |
2026-07-15 |
| snort |
ET EXPLOIT Possible CVE-2015-7547 Large Response to A/AAAA query |
rev 2 |
2026-07-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.blogs .or .id domain |
rev 1 |
2026-07-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.blogs .or .id domain |
rev 1 |
2026-07-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.blogs .or .id domain |
rev 1 |
2026-07-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.blogs .or .id domain |
rev 1 |
2026-07-15 |
| splunk |
Windows Local LLM Framework Execution |
production |
2026-07-15 |
| splunk |
Local LLM Framework DNS Query |
production |
2026-07-15 |