| sigma |
Okta Admin Role Assignment Created |
test |
2026-04-27 |
| sigma |
Okta Suspicious Activity Reported by End-user |
test |
2026-04-27 |
| sigma |
PUA - Memory Dump Mount Via MemProcFS |
experimental |
2026-04-27 |
| sigma |
Okta Network Zone Deactivated or Deleted |
test |
2026-04-27 |
| sigma |
Okta Policy Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta New Admin Console Behaviours |
test |
2026-04-27 |
| sigma |
Potential Okta Password in AlternateID Field |
test |
2026-04-27 |
| sigma |
Okta Unauthorized Access to App |
test |
2026-04-27 |
| sigma |
Okta Application Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta Admin Role Assigned to an User or Group |
test |
2026-04-27 |
| sigma |
Okta User Session Start Via An Anonymising Proxy Service |
test |
2026-04-27 |
| sigma |
Okta Application Sign-On Policy Modified or Deleted |
test |
2026-04-27 |
| sigma |
Okta API Token Created |
test |
2026-04-27 |
| sigma |
Okta Identity Provider Created |
test |
2026-04-27 |
| sigma |
Okta Security Threat Detected |
test |
2026-04-27 |
| sigma |
Okta User Account Locked Out |
test |
2026-04-27 |
| sigma |
Okta MFA Reset or Deactivated |
test |
2026-04-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thehor .com domain |
rev 1 |
2026-04-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thehor .com domain |
rev 1 |
2026-04-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| snort |
ET TROJAN APT36 Victim Beacon M2 |
rev 1 |
2026-04-24 |
| snort |
ET TROJAN APT36 Victim Beacon M1 |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| suricata |
ET MALWARE APT36 Victim Beacon M1 |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| suricata |
ET MALWARE APT36 Victim Beacon M2 |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.auxgroup .com .au domain |
rev 1 |
2026-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ncknms .com domain |
rev 1 |
2026-04-24 |
| snort |
ET TROJAN TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration |
rev 1 |
2026-04-23 |
| suricata |
ET MALWARE TeamPCP CanisterWorm - Namastex npm Campaign - Exfiltration |
rev 1 |
2026-04-23 |
| snort |
ET TROJAN MakinoLoader CnC Checkin Attempt |
rev 1 |
2026-04-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader Tasking Request |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader Systeminfo Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| snort |
ET TROJAN MakinoLoader EDR Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader CnC Checkin Attempt |
rev 1 |
2026-04-21 |