| sigma |
Potential Vcruntime140 DLL Sideloading |
experimental |
2026-05-18 |
| snort |
ET EXPLOIT IBM Data Risk Manager Arbitrary File Download Attempt |
rev 3 |
2026-05-15 |
| snort |
ET TROJAN Wordpress Social Warfare Plugin Attempted Admin User Creation |
rev 2 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET MALWARE Wordpress Social Warfare Plugin Attempted Admin User Creation |
rev 2 |
2026-05-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.craigkeen .com domain |
rev 1 |
2026-05-15 |
| suricata |
ET EXPLOIT IBM Data Risk Manager Arbitrary File Download Attempt |
rev 2 |
2026-05-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN SainboxRAT CnC Config Request |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN Observed DNS Query to Sainbox Domain |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| snort |
ET TROJAN Observed Sainbox Domain in TLS SNI |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.colloky .com .pe domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE SainboxRAT CnC Config Request |
rev 1 |
2026-05-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thongthaitextile .com domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE Observed DNS Query to Sainbox Domain |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE SainboxRAT CnC Checkin |
rev 1 |
2026-05-14 |
| suricata |
ET MALWARE Observed Sainbox Domain in TLS SNI |
rev 1 |
2026-05-14 |
| splunk |
Splunk RCE via User XSLT |
production |
2026-05-14 |
| splunk |
Splunk User Enumeration Attempt |
production |
2026-05-14 |
| splunk |
Splunk Sensitive Information Disclosure in DEBUG Logging Channels |
production |
2026-05-14 |
| splunk |
Splunk XSS Privilege Escalation via Custom Urls in Dashboard |
production |
2026-05-14 |
| splunk |
Detect New Open S3 Buckets over AWS CLI |
production |
2026-05-13 |
| splunk |
M365 Copilot Information Extraction Jailbreak Attack |
production |
2026-05-13 |
| splunk |
M365 Copilot Agentic Jailbreak Attack |
production |
2026-05-13 |
| splunk |
M365 Copilot Jailbreak Attempts |
production |
2026-05-13 |
| splunk |
Detect Excessive User Account Lockouts |
production |
2026-05-13 |
| snort |
ET ATTACK_RESPONSE EtherHiding Payload Delivery Script Observed Inbound |
rev 1 |
2026-05-13 |
| suricata |
ET ATTACK_RESPONSE EtherHiding Payload Delivery Script Observed Inbound |
rev 1 |
2026-05-13 |
| splunk |
Detect malicious requests to exploit JBoss servers |
experimental |
2026-05-13 |
| splunk |
Exploit Public Facing Application via Apache Commons Text |
production |
2026-05-13 |
| splunk |
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 |
production |
2026-05-13 |
| splunk |
F5 TMUI Authentication Bypass |
production |
2026-05-13 |