| sigma |
Sysinternals PsSuspend Suspicious Execution |
test |
2026-06-29 |
| sigma |
Process Explorer Driver Creation By Non-Sysinternals Binary |
test |
2026-06-29 |
| sigma |
Sysmon Configuration Update |
test |
2026-06-29 |
| sigma |
Sysinternals PsService Execution |
test |
2026-06-29 |
| sigma |
Suspicious Use of PsLogList |
test |
2026-06-29 |
| sigma |
Procdump Execution |
test |
2026-06-29 |
| sigma |
Process Monitor Driver Creation By Non-Sysinternals Binary |
test |
2026-06-29 |
| sigma |
Sysinternals PsSuspend Execution |
test |
2026-06-29 |
| splunk |
PowerShell Domain Enumeration |
production |
2026-06-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| snort |
ET INFO Javascript Mobile Device Check |
rev 1 |
2026-06-26 |
| suricata |
ET EXPLOIT_KIT ErrTraffic Beer Cluster Checkin |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING Javascript Mobile Device Check |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sprinkul .com domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hospitaldelninodif .gob .mx domain |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING FakeUpdate Injector Script Request |
rev 1 |
2026-06-26 |
| suricata |
ET HUNTING CoGUI Fingerprint Activity |
rev 1 |
2026-06-25 |
| splunk |
Suspicious Process With Discord DNS Query |
production |
2026-06-25 |
| splunk |
Windows Unusual FileZilla XML Config Access |
production |
2026-06-25 |
| splunk |
Windows Browser Process Launched with Unusual Flags |
production |
2026-06-25 |
| splunk |
Windows Chromium Browser with Custom User Data Directory |
production |
2026-06-25 |
| splunk |
Windows File Transfer Protocol In Non-Common Process Path |
production |
2026-06-25 |
| splunk |
Windows Chromium Browser No Security Sandbox Process |
production |
2026-06-25 |
| splunk |
Windows Powershell Cryptography Namespace |
production |
2026-06-25 |
| splunk |
PowerShell PInvoke Process Injection API Chain |
production |
2026-06-25 |
| splunk |
Windows Credentials from Password Stores Chrome Copied in TEMP Dir |
production |
2026-06-25 |
| splunk |
Windows Unusual Process Load Mozilla NSS-Mozglue Module |
production |
2026-06-25 |
| splunk |
Windows System Network Connections Discovery Netsh |
production |
2026-06-25 |
| splunk |
Windows Disable or Modify Tools Via Taskkill |
production |
2026-06-25 |
| splunk |
Powershell Fileless Script Contains Base64 Encoded Content |
production |
2026-06-25 |
| splunk |
Windows Non Discord App Access Discord LevelDB |
production |
2026-06-25 |
| splunk |
Headless Browser Usage |
production |
2026-06-25 |
| splunk |
Splunk Authentication Token Exposure in Debug Log |
production |
2026-06-24 |
| snort |
ET INFO Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |
| suricata |
ET HUNTING Automox RMM Installer Downloaded From 3rd Party |
rev 1 |
2026-06-23 |