| sigma |
Suspicious File Download From File Sharing Websites - File Stream |
test |
2026-03-29 |
| sigma |
Remote AppX Package Downloaded from File Sharing or CDN Domain |
test |
2026-03-29 |
| sigma |
Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE |
test |
2026-03-29 |
| sigma |
Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE |
test |
2026-03-29 |
| sigma |
HackTool - NetExec Execution |
experimental |
2026-03-29 |
| sigma |
Suspicious File Download From File Sharing Domain Via Wget.EXE |
test |
2026-03-29 |
| sigma |
Suspicious Download From File-Sharing Website Via Bitsadmin |
test |
2026-03-29 |
| sigma |
Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location |
test |
2026-03-29 |
| sigma |
Curl File Upload To File Sharing Websites |
experimental |
2026-03-29 |
| sigma |
Suspicious File Download From File Sharing Domain Via Curl.EXE |
test |
2026-03-29 |
| sigma |
BITS Transfer Job Download From File Sharing Domains |
test |
2026-03-29 |
| sigma |
Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder |
test |
2026-03-29 |
| sigma |
New Connection Initiated To Potential Dead Drop Resolver Domain |
test |
2026-03-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.connorliam .com domain |
rev 1 |
2026-03-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.connorliam .com domain |
rev 1 |
2026-03-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.metrojoinery .com .au domain |
rev 1 |
2026-03-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.metrojoinery .com .au domain |
rev 1 |
2026-03-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.metrojoinery .com .au domain |
rev 1 |
2026-03-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.metrojoinery .com .au domain |
rev 1 |
2026-03-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.connorliam .com domain |
rev 1 |
2026-03-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.connorliam .com domain |
rev 1 |
2026-03-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.myers-usa .com domain |
rev 1 |
2026-03-27 |
| snort |
ET TROJAN TeamPCP CnC Activity Observed |
rev 1 |
2026-03-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.myers-usa .com domain |
rev 1 |
2026-03-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.imagetemplate .com domain |
rev 1 |
2026-03-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.imagetemplate .com domain |
rev 1 |
2026-03-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.imagetemplate .com domain |
rev 1 |
2026-03-27 |
| suricata |
ET MALWARE TeamPCP CnC Activity Observed |
rev 1 |
2026-03-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.myers-usa .com domain |
rev 1 |
2026-03-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.imagetemplate .com domain |
rev 1 |
2026-03-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.myers-usa .com domain |
rev 1 |
2026-03-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.vigorpm .com domain |
rev 1 |
2026-03-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.divvyboard .com domain |
rev 1 |
2026-03-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.divvyboard .com domain |
rev 1 |
2026-03-26 |
| snort |
ET INFO Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt |
rev 1 |
2026-03-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.vigorpm .com domain |
rev 1 |
2026-03-26 |
| suricata |
ET HUNTING Fortigate Forticlient EMS Multi-Tennant Fingerprinting Attempt |
rev 1 |
2026-03-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.vigorpm .com domain |
rev 1 |
2026-03-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.divvyboard .com domain |
rev 1 |
2026-03-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.vigorpm .com domain |
rev 1 |
2026-03-26 |