| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dynu .org |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.opik .net domain |
rev 1 |
2026-04-27 |
| snort |
ET TROJAN TA582 CnC Checkin |
rev 2 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.opik .net domain |
rev 1 |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dynu .org |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dynu .net |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.opik .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dynu .net |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ezgateway .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.rabsacca .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET INFO Powershell Command With Encoded Argument Over SMB - Likely Lateral Movement |
rev 2 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yyuyy .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.starnightimport .com domain |
rev 1 |
2026-04-27 |
| suricata |
ET MALWARE TA582 CnC Checkin |
rev 2 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.xubi .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.roxa .org domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.opik .net domain |
rev 1 |
2026-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dynu .org |
rev 1 |
2026-04-27 |
| splunk |
Windows MsMpEng Writing to System32 |
production |
2026-04-27 |
| splunk |
Windows Non-System Process Querying Definition Update |
production |
2026-04-27 |
| splunk |
Windows Suspicious Defender Engine or Signature Files Created |
production |
2026-04-27 |
| sigma |
Okta MFA Reset or Deactivated |
test |
2026-04-27 |
| sigma |
Okta Unauthorized Access to App |
test |
2026-04-27 |
| sigma |
Potential Okta Password in AlternateID Field |
test |
2026-04-27 |
| sigma |
Okta Admin Role Assignment Created |
test |
2026-04-27 |
| sigma |
Okta New Admin Console Behaviours |
test |
2026-04-27 |
| sigma |
Okta Admin Role Assigned to an User or Group |
test |
2026-04-27 |
| sigma |
New Okta User Created |
test |
2026-04-27 |