| snort |
ET TROJAN Crpx0 Ransomware Payload Request M1 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M2 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Observed DNS Query to Crpx0 Ransomware Domain |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M3 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN Crpx0 Ransomware Payload Request M4 |
rev 1 |
2026-04-01 |
| snort |
ET TROJAN plain-crypto-js RAT Stage 1 C2 Outbound Request |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M4 |
rev 1 |
2026-04-01 |
| suricata |
ET ADWARE_PUP Niagara Software Update Check |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE plain-crypto-js RAT Stage 1 C2 Outbound Request |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M3 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Observed Crpx0 Ransomware Domain in TLS SNI |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Inbound M2 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE UNK_MonkeyWrench Payload Request |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Inbound M1 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Observed DNS Query to Crpx0 Ransomware Domain |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M1 |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE UNK_MonkeyWrench Exfil via SMTP |
rev 1 |
2026-04-01 |
| suricata |
ET MALWARE Crpx0 Ransomware Payload Request M2 |
rev 1 |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - Linux |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - macOS |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - Windows |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Indicators - Windows |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise Malicious C2 Domain DNS Query |
experimental |
2026-04-01 |
| sigma |
Axios NPM Compromise File Creation Indicators - MacOS |
experimental |
2026-04-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.forever-20 .com domain |
rev 1 |
2026-03-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.forever-20 .com domain |
rev 1 |
2026-03-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.forever-20 .com domain |
rev 1 |
2026-03-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.forever-20 .com domain |
rev 1 |
2026-03-31 |
| sigma |
Suspicious Double Extension Files |
test |
2026-03-31 |
| sigma |
Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation |
experimental |
2026-03-31 |
| sigma |
TeamPCP LiteLLM Supply Chain Attack Persistence Indicators |
experimental |
2026-03-30 |
| sigma |
Security Support Provider (SSP) Added to LSA Configuration |
test |
2026-03-30 |
| sigma |
LiteLLM / TeamPCP Supply Chain Attack Indicators |
experimental |
2026-03-30 |
| sigma |
BPFDoor Abnormal Process ID or Lock File Accessed |
test |
2026-03-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.utilicell .com domain |
rev 1 |
2026-03-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.utilicell .com domain |
rev 1 |
2026-03-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.utilicell .com domain |
rev 1 |
2026-03-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.utilicell .com domain |
rev 1 |
2026-03-29 |
| sigma |
Suspicious File Download From File Sharing Domain Via Wget.EXE |
test |
2026-03-29 |