| suricata |
ET HUNTING 302 Redirect to Microsoft Edge Browser |
rev 1 |
2026-03-18 |
| sigma |
Chmod Targeting Sensitive Directories |
test |
2026-03-18 |
| sigma |
Potential Suspicious Change To Sensitive/Critical Files |
test |
2026-03-18 |
| sigma |
Linux Logs Clearing Attempts |
stable |
2026-03-18 |
| snort |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M2 |
rev 1 |
2026-03-17 |
| snort |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M1 |
rev 1 |
2026-03-17 |
| suricata |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M2 |
rev 1 |
2026-03-17 |
| suricata |
ET INFO Insecure Proxy Discovery via AWS Instance Metadata Retrieval M1 |
rev 1 |
2026-03-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.oglesbypm .com domain |
rev 1 |
2026-03-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.oglesbypm .com domain |
rev 1 |
2026-03-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.oglesbypm .com domain |
rev 1 |
2026-03-16 |
| suricata |
ET HUNTING Dropbox Hosted PDF with an Encoded Filename |
rev 1 |
2026-03-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.oglesbypm .com domain |
rev 1 |
2026-03-16 |
| sigma |
Suspicious Copy From or To System Directory |
test |
2026-03-16 |
| sigma |
Uncommon File Created by Notepad++ Updater Gup.EXE |
experimental |
2026-03-16 |
| sigma |
Powershell Token Obfuscation - Process Creation |
test |
2026-03-16 |
| sigma |
Invoke-Obfuscation Obfuscated IEX Invocation |
test |
2026-03-16 |
| sigma |
Obfuscated IP Download Activity |
test |
2026-03-16 |
| sigma |
Obfuscated IP Via CLI |
test |
2026-03-16 |
| sigma |
Notepad++ Updater DNS Query to Uncommon Domains |
experimental |
2026-03-16 |
| sigma |
Potential Rundll32 Execution With DLL Stored In ADS |
test |
2026-03-16 |
| sigma |
Invoke-Obfuscation Via Use Clip |
test |
2026-03-16 |
| sigma |
Invoke-Obfuscation Via Stdin |
test |
2026-03-16 |
| snort |
ET INFO Xeox RMM Agent Activity |
rev 1 |
2026-03-13 |
| suricata |
ET JA3 Hash - Possible SoftEther Server-Side Traffic |
rev 1 |
2026-03-13 |
| suricata |
ET INFO Xeox RMM Agent Activity |
rev 1 |
2026-03-13 |
| sigma |
LSA PPL Protection Setting Modification via CommandLine |
test |
2026-03-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.muskaengsarl .com domain |
rev 1 |
2026-03-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.muskaengsarl .com domain |
rev 1 |
2026-03-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.gandurlog .com domain |
rev 1 |
2026-03-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.gandurlog .com domain |
rev 1 |
2026-03-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.polatoglumimarlik .com domain |
rev 1 |
2026-03-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.polatoglumimarlik .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.muskaengsarl .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.polatoglumimarlik .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gandurlog .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.muskaengsarl .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.polatoglumimarlik .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.gandurlog .com domain |
rev 1 |
2026-03-12 |
| suricata |
ET EXPLOIT_KIT Coruna Stage 2 Implant Activity |
rev 1 |
2026-03-11 |