| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| suricata |
ET INFO Transportation Cargo Theft Domain in DNS Lookup |
rev 1 |
2026-05-04 |
| sigma |
UFW Disable Attempt |
test |
2026-05-04 |
| sigma |
FortiGate - New Firewall Policy Added |
experimental |
2026-05-04 |
| sigma |
FortiGate - Firewall Address Object Added |
experimental |
2026-05-04 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.medipath .com domain |
rev 1 |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.medipath .com domain |
rev 1 |
2026-05-01 |
| snort |
ET CURRENT_EVENTS DeviceCode Phishing Landing Page Observed |
rev 2 |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.antakshari .com domain |
rev 1 |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.southwestvoodoo .com domain |
rev 1 |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.southwestvoodoo .com domain |
rev 1 |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.antakshari .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.southwestvoodoo .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET PHISHING DeviceCode Phishing Landing Page Observed |
rev 2 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.southwestvoodoo .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.antakshari .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.antakshari .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.medipath .com domain |
rev 1 |
2026-05-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.medipath .com domain |
rev 1 |
2026-05-01 |
| splunk |
Windows Suspicious Child Process of TieringEngineService.exe |
production |
2026-05-01 |
| splunk |
Windows Cloud Files Filter Log Created by Non-System Process |
production |
2026-05-01 |
| splunk |
Windows VSSVC Process Accessing Defender Engine |
production |
2026-05-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.flashhub .net domain |
rev 1 |
2026-04-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.flashhub .net domain |
rev 1 |
2026-04-30 |
| suricata |
ET MALWARE eCh0raix/QNAPCrypt Requesting Key/Wallet/Note |
rev 2 |
2026-04-30 |
| suricata |
ET MALWARE eCh0raix/QNAPCrypt Successful Server Response |
rev 3 |
2026-04-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.flashhub .net domain |
rev 1 |
2026-04-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.flashhub .net domain |
rev 1 |
2026-04-30 |
| sigma |
Linux AF_ALG Socket Creation - Kernel Crypto API Exploit Indicator |
experimental |
2026-04-30 |
| sigma |
RedTail Cryptominer User-Agent |
experimental |
2026-04-30 |
| sigma |
Azure Device No Longer Managed or Compliant |
test |
2026-04-30 |
| sigma |
Azure Service Principal Created |
test |
2026-04-30 |
| sigma |
Azure Application Deleted |
test |
2026-04-30 |
| sigma |
Azure Service Principal Removed |
test |
2026-04-30 |
| sigma |
Azure Owner Removed From Application or Service Principal |
test |
2026-04-30 |
| sigma |
Disabled MFA to Bypass Authentication Mechanisms |
test |
2026-04-30 |
| sigma |
User Added to an Administrator's Azure AD Role |
test |
2026-04-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.remotewire .net domain |
rev 1 |
2026-04-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.remotewire .net domain |
rev 1 |
2026-04-29 |
| snort |
ET INFO Amazon Cloudfront Geoblock Landing Page |
rev 1 |
2026-04-29 |