| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.vigorpm .com domain |
rev 1 |
2026-03-26 |
| sigma |
AppLocker Application Would Have Been Blocked |
experimental |
2026-03-26 |
| snort |
ET TROJAN InstallFix MacOS CnC Activity M3 |
rev 1 |
2026-03-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.shankillweather .com domain |
rev 1 |
2026-03-25 |
| snort |
ET ATTACK_RESPONSE InstallFix MacOS Payload Inbound |
rev 1 |
2026-03-25 |
| snort |
ET TROJAN InstallFix MacOS CnC Activity M1 |
rev 1 |
2026-03-25 |
| snort |
ET TROJAN InstallFix MacOS CnC Activity M2 |
rev 1 |
2026-03-25 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.shankillweather .com domain |
rev 1 |
2026-03-25 |
| suricata |
ET MALWARE InstallFix MacOS CnC Activity M1 |
rev 1 |
2026-03-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.shankillweather .com domain |
rev 1 |
2026-03-25 |
| suricata |
ET MALWARE InstallFix MacOS CnC Activity M2 |
rev 1 |
2026-03-25 |
| suricata |
ET ATTACK_RESPONSE InstallFix MacOS Payload Inbound |
rev 1 |
2026-03-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.shankillweather .com domain |
rev 1 |
2026-03-25 |
| suricata |
ET MALWARE InstallFix MacOS CnC Activity M3 |
rev 1 |
2026-03-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.alexanderthegreater .com domain |
rev 1 |
2026-03-24 |
| snort |
ET TROJAN RMM Payload Delivery Behvaior Observed in HTTP Cookies |
rev 1 |
2026-03-24 |
| snort |
ET TROJAN DarkSword C2 Landing Page |
rev 1 |
2026-03-24 |
| snort |
ET INFO VibeCoded MSI Installer VBS Script Inbound |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.zhunzi .com domain |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.alexanderthegreater .com domain |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.evaandering .com domain |
rev 1 |
2026-03-24 |
| snort |
ET INFO Detect iPhone or MacOS Device and Force Safari Usage |
rev 1 |
2026-03-24 |
| snort |
ET TROJAN Observed Fake Google Meet Page |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.zhunzi .com domain |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.evaandering .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.alexanderthegreater .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.alexanderthegreater .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.zhunzi .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.zhunzi .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET MALWARE DarkSword C2 Landing Page |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.evaandering .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET MALWARE RMM Payload Delivery Behvaior Observed in HTTP Cookies |
rev 1 |
2026-03-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.evaandering .com domain |
rev 1 |
2026-03-24 |
| suricata |
ET HUNTING VibeCoded MSI Installer VBS Script Inbound |
rev 1 |
2026-03-24 |
| suricata |
ET HUNTING Detect iPhone or MacOS Device and Force Safari Usage |
rev 1 |
2026-03-24 |
| suricata |
ET MALWARE Observed Fake Google Meet Page |
rev 1 |
2026-03-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.issurroundedbyidiots .net domain |
rev 1 |
2026-03-23 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.geocen .org domain |
rev 1 |
2026-03-23 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.vsltech .net domain |
rev 1 |
2026-03-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.geocen .org domain |
rev 1 |
2026-03-23 |