| splunk |
Linux Suspicious Namespace Creation |
production |
2026-05-12 |
| splunk |
Powershell Defender Threat Actions Set to Allow |
production |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack Execution Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Linux |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack File Creation Indicators - Windows |
experimental |
2026-05-12 |
| sigma |
TanStack Supply-Chain Attack DNS Indicators |
experimental |
2026-05-12 |
| snort |
ET TROJAN MagicG Stealer CnC Exfil Confirmation |
rev 1 |
2026-05-11 |
| snort |
ET TROJAN HumanitarianBait Infostealer CnC File Exfil |
rev 1 |
2026-05-11 |
| suricata |
ET MALWARE HumanitarianBait Infostealer CnC File Exfil |
rev 1 |
2026-05-11 |
| suricata |
ET MALWARE MagicG Stealer CnC Exfil Confirmation |
rev 1 |
2026-05-11 |
| sigma |
Legitimate Application Dropped Script |
test |
2026-05-11 |
| sigma |
Legitimate Application Dropped Executable |
test |
2026-05-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.choicharlie .com domain |
rev 1 |
2026-05-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.choicharlie .com domain |
rev 1 |
2026-05-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.choicharlie .com domain |
rev 1 |
2026-05-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.choicharlie .com domain |
rev 1 |
2026-05-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.redlight .li domain |
rev 1 |
2026-05-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.redlight .li domain |
rev 1 |
2026-05-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.redlight .li domain |
rev 1 |
2026-05-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.redlight .li domain |
rev 1 |
2026-05-09 |
| sigma |
Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator |
experimental |
2026-05-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cowher .net domain |
rev 1 |
2026-05-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cowin-eng .com domain |
rev 1 |
2026-05-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cowher .net domain |
rev 1 |
2026-05-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dapit .net domain |
rev 1 |
2026-05-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cowin-eng .com domain |
rev 1 |
2026-05-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dapit .net domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dapit .net domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cowher .net domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cowin-eng .com domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cowher .net domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cowin-eng .com domain |
rev 1 |
2026-05-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dapit .net domain |
rev 1 |
2026-05-08 |
| snort |
ET TROJAN PHASEJAM Web Shell Activity Observed M1 |
rev 2 |
2026-05-07 |
| snort |
ET TROJAN PHASEJAM Web Shell Activity Observed M2 |
rev 2 |
2026-05-07 |
| suricata |
ET MALWARE PHASEJAM Web Shell Activity Observed M1 |
rev 2 |
2026-05-07 |
| suricata |
ET MALWARE PHASEJAM Web Shell Activity Observed M2 |
rev 2 |
2026-05-07 |
| snort |
ET TROJAN LedgerCheck User-Agent Observed |
rev 1 |
2026-05-06 |
| suricata |
ET MALWARE LedgerCheck User-Agent Observed |
rev 1 |
2026-05-06 |