| sigma |
Clipboard Access Via OSAScript |
test |
2026-05-22 |
| snort |
ET TROJAN implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| snort |
ET TROJAN implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| snort |
ET CURRENT_EVENTS Operation HookedWing Landing Page Observed |
rev 1 |
2026-05-21 |
| snort |
ET CURRENT_EVENTS Operation HookedWing Form Injection Payload Request |
rev 1 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Windows Beacon Check-in |
rev 3 |
2026-05-21 |
| suricata |
ET PHISHING Operation HookedWing Landing Page Observed |
rev 1 |
2026-05-21 |
| suricata |
ET PHISHING Operation HookedWing Form Injection Payload Request |
rev 1 |
2026-05-21 |
| suricata |
ET MALWARE implant.js Linux Beacon Check-in |
rev 3 |
2026-05-21 |
| sigma |
MacOS Scripting Interpreter AppleScript |
test |
2026-05-21 |
| sigma |
Signed DLL Loaded With Missing PE Version Metadata |
experimental |
2026-05-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sgmlguru .org domain |
rev 1 |
2026-05-20 |
| splunk |
Cisco IOS XE Reconnaissance Command Activity |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Guestshell Activation and Destroy |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Tunnel Interface Configuration |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Remote Access Probe Burst |
production |
2026-05-20 |
| splunk |
Cisco IOS XE Request Platform Package Describe Shell Pattern |
production |
2026-05-20 |
| splunk |
Windows FFmpeg DirectShow Video Capture |
production |
2026-05-20 |
| splunk |
Cisco IOS XE VTY Access Class Tampering |
production |
2026-05-20 |
| splunk |
Windows FFmpeg Audio and Video Device Discovery |
production |
2026-05-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bdyoutube .com domain |
rev 1 |
2026-05-19 |
| splunk |
Cisco IOS XE WebUI Login From IOSd Local Port |
production |
2026-05-19 |
| snort |
ET CURRENT_EVENTS Phish Link Click Confirmation via Telegram Bot |
rev 1 |
2026-05-18 |
| snort |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| snort |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE ScreenConnect RMM Payload Delivered via Fake Docusign Page |
rev 1 |
2026-05-18 |
| suricata |
ET PHISHING Phish Link Click Confirmation via Telegram Bot |
rev 1 |
2026-05-18 |
| suricata |
ET ATTACK_RESPONSE RMM Payload Delivery Page Observed |
rev 1 |
2026-05-18 |
| splunk |
Windows Cloud Files Filter Loaded by Uncommon Process |
production |
2026-05-18 |
| sigma |
Potential Vcruntime140 DLL Sideloading |
experimental |
2026-05-18 |
| sigma |
Creation of WerFault.exe/Wer.dll in Unusual Folder |
test |
2026-05-18 |
| sigma |
File And SubFolder Enumeration Via Dir Command |
test |
2026-05-18 |
| sigma |
Suspicious Start-Process PassThru |
test |
2026-05-18 |