| splunk |
Splunk RCE Through Arbitrary File Write to Windows System Root |
production |
2026-06-23 |
| snort |
ET TROJAN GoldenGh0stLoader Websocket Checkin - C2 Response |
rev 1 |
2026-06-22 |
| snort |
ET TROJAN GoldenGh0stLoader Directory Listing Command From C2 |
rev 1 |
2026-06-22 |
| suricata |
ET MALWARE GoldenGh0stLoader Websocket Checkin - C2 Response |
rev 1 |
2026-06-22 |
| suricata |
ET MALWARE GoldenGh0stLoader Directory Listing Command From C2 |
rev 1 |
2026-06-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.npmpt .com domain |
rev 1 |
2026-06-21 |
| sigma |
Process Execution From Shared Memory Directory |
experimental |
2026-06-20 |
| sigma |
NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE |
test |
2026-06-19 |
| sigma |
Registry Manipulation via WMI Stdregprov |
experimental |
2026-06-19 |
| sigma |
Registry Enumeration via WMI Stdregprov |
experimental |
2026-06-19 |
| suricata |
ET PHISHING Attacker Polling for Device Code Verification |
rev 1 |
2026-06-18 |
| sigma |
CobaltStrike Named Pipe Pattern Regex |
test |
2026-06-18 |
| snort |
ET TROJAN RevStealer Data Exfiltration Attempt M2 |
rev 1 |
2026-06-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer CnC Checkin |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer Data Exfiltration Attempt M1 |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer Sync Request |
rev 1 |
2026-06-17 |
| snort |
ET TROJAN RevStealer dl_exec Command from C2 |
rev 1 |
2026-06-17 |
| snort |
ET EXPLOIT Balada Javascript Inject Observed |
rev 1 |
2026-06-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer dl_exec Command from C2 |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer CnC Checkin |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer Sync Request |
rev 1 |
2026-06-17 |
| suricata |
ET EXPLOIT_KIT Balada Javascript Inject Observed |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer Data Exfiltration Attempt M2 |
rev 1 |
2026-06-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.juk .fi domain |
rev 1 |
2026-06-17 |
| suricata |
ET MALWARE RevStealer Data Exfiltration Attempt M1 |
rev 1 |
2026-06-17 |
| snort |
ET INFO Javascript Obfuscator Charcode+Hex Encoded Function Name |
rev 1 |
2026-06-16 |
| suricata |
ET HUNTING Javascript Obfuscator Charcode+Hex Encoded Function Name |
rev 1 |
2026-06-16 |
| sigma |
Antivirus - Password Dumper Signature |
stable |
2026-06-15 |
| sigma |
Antivirus - APT Malware Signature |
experimental |
2026-06-15 |
| sigma |
Antivirus - Hacktool Signature |
stable |
2026-06-15 |
| sigma |
Antivirus - Exploitation Framework Signature |
stable |
2026-06-15 |
| sigma |
Antivirus - Ransomware Signature |
test |
2026-06-15 |
| sigma |
Antivirus - Remote Access Tools Signature |
experimental |
2026-06-15 |
| splunk |
PTC Windchill GW READY OK Probe |
production |
2026-06-14 |