| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.lienenbert .com domain |
rev 1 |
2026-04-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.lienenbert .com domain |
rev 1 |
2026-04-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.maverickden .com domain |
rev 1 |
2026-04-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.maverickden .com domain |
rev 1 |
2026-04-09 |
| snort |
ET TROJAN SonOyuncu Stealer Exfil via Discord |
rev 1 |
2026-04-09 |
| suricata |
ET MALWARE SonOyuncu Stealer Exfil via Discord |
rev 1 |
2026-04-09 |
| suricata |
ET MALWARE SonOyuncu Stealer User-Agent Observed |
rev 1 |
2026-04-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.maverickden .com domain |
rev 1 |
2026-04-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.lienenbert .com domain |
rev 1 |
2026-04-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.maverickden .com domain |
rev 1 |
2026-04-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lienenbert .com domain |
rev 1 |
2026-04-09 |
| snort |
ET CURRENT_EVENTS EvilTokens Fetch Valid user_code from Microsoft API |
rev 1 |
2026-04-08 |
| snort |
ET INFO MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt |
rev 1 |
2026-04-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.modburypress .com .au domain |
rev 1 |
2026-04-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.modburypress .com .au domain |
rev 1 |
2026-04-08 |
| snort |
ET CURRENT_EVENTS EvilTokens Poll for user_code Authentication Status |
rev 1 |
2026-04-08 |
| suricata |
ET PHISHING EvilTokens Poll for user_code Authentication Status |
rev 1 |
2026-04-08 |
| suricata |
ET PHISHING EvilTokens Fetch Valid user_code from Microsoft API |
rev 1 |
2026-04-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.modburypress .com .au domain |
rev 1 |
2026-04-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.modburypress .com .au domain |
rev 1 |
2026-04-08 |
| suricata |
ET HUNTING MethodInvokingFactoryBean java.lang.Runtime getRuntime exec method XML Payload Request - Possible Remote Code Execution Attempt |
rev 1 |
2026-04-08 |
| sigma |
HackTool - NetExec File Indicators |
experimental |
2026-04-08 |
| snort |
ET TROJAN AuraC2 Victim Registration |
rev 1 |
2026-04-07 |
| snort |
ET TROJAN AuraC2 Victim Beacon |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.whiskydice .com domain |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mjfinancialservices .com domain |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.misty-vale .com domain |
rev 1 |
2026-04-07 |
| snort |
ET TROJAN AuraC2 Exfil Confirmation |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.misty-vale .com domain |
rev 1 |
2026-04-07 |
| snort |
ET TROJAN AuraC2 Victim Registration Confirmation |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.whiskydice .com domain |
rev 1 |
2026-04-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mjfinancialservices .com domain |
rev 1 |
2026-04-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mjfinancialservices .com domain |
rev 1 |
2026-04-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mjfinancialservices .com domain |
rev 1 |
2026-04-07 |
| suricata |
ET MALWARE AuraC2 Victim Registration Confirmation |
rev 1 |
2026-04-07 |
| suricata |
ET MALWARE AuraC2 Exfil Confirmation |
rev 1 |
2026-04-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.whiskydice .com domain |
rev 1 |
2026-04-07 |
| suricata |
ET MALWARE AuraC2 Victim Registration |
rev 1 |
2026-04-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.misty-vale .com domain |
rev 1 |
2026-04-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.misty-vale .com domain |
rev 1 |
2026-04-07 |