| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.remotewire .net domain |
rev 1 |
2026-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.remotewire .net domain |
rev 1 |
2026-04-29 |
| suricata |
ET HUNTING Amazon Cloudfront Geoblock Landing Page |
rev 1 |
2026-04-29 |
| splunk |
Windows Suspicious Burst of Password Changes |
production |
2026-04-29 |
| sigma |
Potential WinAPI Calls Via PowerShell Scripts |
test |
2026-04-29 |
| snort |
ET TROJAN PhantomPulse RAT Payload Update Attempt |
rev 1 |
2026-04-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mytunnel .org domain |
rev 1 |
2026-04-28 |
| snort |
ET TROJAN PhantomPulse RAT CnC Checkin Attempt |
rev 1 |
2026-04-28 |
| snort |
ET TROJAN PhantomPulse RAT Loader Checkin Attempt |
rev 1 |
2026-04-28 |
| snort |
ET TROJAN PhantomPulse RAT Tasking Request |
rev 1 |
2026-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mytunnel .org domain |
rev 1 |
2026-04-28 |
| snort |
ET INFO IKEv2 SA_INIT with Microsoft Security Realm Vendor ID |
rev 1 |
2026-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mytunnel .org domain |
rev 1 |
2026-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mytunnel .org domain |
rev 1 |
2026-04-28 |
| suricata |
ET MALWARE PhantomPulse RAT CnC Checkin Attempt |
rev 1 |
2026-04-28 |
| suricata |
ET MALWARE PhantomPulse RAT Payload Update Attempt |
rev 1 |
2026-04-28 |
| suricata |
ET INFO IKEv2 SA_INIT with Microsoft Security Realm Vendor ID |
rev 1 |
2026-04-28 |
| suricata |
ET MALWARE PhantomPulse RAT Tasking Request |
rev 1 |
2026-04-28 |
| suricata |
ET MALWARE PhantomPulse RAT Loader Checkin Attempt |
rev 1 |
2026-04-28 |
| sigma |
EvilTokens PhaaS Kit Phishing Related Request - Proxy |
experimental |
2026-04-28 |
| sigma |
Azure Sign-In With Axios User Agent |
experimental |
2026-04-28 |
| sigma |
Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI |
test |
2026-04-28 |
| sigma |
PowerShell Download Via Net.WebClient - PowerShell Classic |
test |
2026-04-28 |
| sigma |
Sensitive File Dump Via Print.EXE |
test |
2026-04-28 |
| sigma |
Google Workspace Government Attack Warning |
experimental |
2026-04-28 |
| sigma |
New Cron File Created |
experimental |
2026-04-28 |
| sigma |
Kubernetes Potential Enumeration Activity |
experimental |
2026-04-28 |
| sigma |
Cisco Dot1x Disabled |
experimental |
2026-04-28 |
| sigma |
Google Workspace Out Of Domain Email Forwarding |
experimental |
2026-04-28 |
| sigma |
Potential Exploitation of CVE-2025-5054 or CVE-2025-4598 |
experimental |
2026-04-28 |
| snort |
ET POLICY Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dynu .net |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dynu .org |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |