| suricata |
ET MALWARE MakinoLoader EDR Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader Systeminfo Data Exfiltration Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| suricata |
ET MALWARE MakinoLoader CnC Checkin Attempt |
rev 1 |
2026-04-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sulekutlay .com domain |
rev 1 |
2026-04-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.fiedleracres .com domain |
rev 1 |
2026-04-17 |
| snort |
ET CURRENT_EVENTS Successful Wahala Microsoft OAuth Device Code Attack, Polling for User Validated Tokens |
rev 1 |
2026-04-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.fiedleracres .com domain |
rev 1 |
2026-04-17 |
| suricata |
ET PHISHING Successful Wahala Microsoft OAuth Device Code Attack, Polling for User Validated Tokens |
rev 1 |
2026-04-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.fiedleracres .com domain |
rev 1 |
2026-04-17 |
| suricata |
ET PHISHING Wahala Microsoft OAuth Device Code Landing Page 2026-04-16 |
rev 1 |
2026-04-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.fiedleracres .com domain |
rev 1 |
2026-04-17 |
| sigma |
RedSun - TieringEngineService.exe Staged in RS-Prefixed Temp Dir |
experimental |
2026-04-17 |
| sigma |
RedSun - Conhost.exe Spawned by TieringEngineService.exe |
experimental |
2026-04-17 |
| sigma |
RedSun - Named Pipe Created |
experimental |
2026-04-17 |
| sigma |
RedSun - TieringEngineService.exe Detected as EICAR Test File |
experimental |
2026-04-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.isfacat .net domain |
rev 1 |
2026-04-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.gandurlogistics .com domain |
rev 1 |
2026-04-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.isfacat .net domain |
rev 1 |
2026-04-16 |
| snort |
ET TROJAN COMSUON Stealer Exfil via Telegram |
rev 1 |
2026-04-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.gandurlogistics .com domain |
rev 1 |
2026-04-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.isfacat .net domain |
rev 1 |
2026-04-16 |
| suricata |
ET MALWARE COMSUON Stealer Exfil via Telegram |
rev 1 |
2026-04-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.gandurlogistics .com domain |
rev 1 |
2026-04-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gandurlogistics .com domain |
rev 1 |
2026-04-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.isfacat .net domain |
rev 1 |
2026-04-16 |
| snort |
ET TROJAN ShadowLink IoT Botnet CnC Tasking Output Response |
rev 1 |
2026-04-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.larryfthompson .com domain |
rev 1 |
2026-04-15 |
| snort |
ET TROJAN ShadowLink IoT Botnet CnC Checkin Attempt M2 |
rev 1 |
2026-04-15 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.network-xxiii .net domain |
rev 1 |
2026-04-15 |
| snort |
ET TROJAN ShadowLink IoT Botnet CnC Tasking Request |
rev 1 |
2026-04-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.larryfthompson .com domain |
rev 1 |
2026-04-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.network-xxiii .net domain |
rev 1 |
2026-04-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.larryfthompson .com domain |
rev 1 |
2026-04-15 |
| suricata |
ET MALWARE ShadowLink IoT Botnet CnC Tasking Output Response |
rev 1 |
2026-04-15 |
| suricata |
ET MALWARE ShadowLink IoT Botnet CnC Tasking Request |
rev 1 |
2026-04-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.larryfthompson .com domain |
rev 1 |
2026-04-15 |
| suricata |
ET MALWARE ShadowLink IoT Botnet CnC Checkin Attempt M2 |
rev 1 |
2026-04-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.network-xxiii .net domain |
rev 1 |
2026-04-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.network-xxiii .net domain |
rev 1 |
2026-04-15 |