| suricata |
ET EXPLOIT_KIT Coruna Stage 2 Implant Activity |
rev 1 |
2026-03-11 |
| suricata |
ET EXPLOIT_KIT Coruna Stage 3 Implant Activity M1 |
rev 1 |
2026-03-11 |
| sigma |
Important Scheduled Task Deleted or Disabled |
test |
2026-03-11 |
| sigma |
System Restore Registry Modification via CommandLine |
experimental |
2026-03-11 |
| sigma |
Delete Important Scheduled Task |
test |
2026-03-11 |
| sigma |
Disable Important Scheduled Task |
test |
2026-03-11 |
| snort |
ET ATTACK_RESPONSE ASP.NET Web BackDoor Webshell Title Banner Observed |
rev 1 |
2026-03-10 |
| suricata |
ET ATTACK_RESPONSE ASP.NET Web BackDoor Webshell Title Banner Observed |
rev 1 |
2026-03-10 |
| snort |
ET CURRENT_EVENTS Coruna Device Fingerprinting M4 |
rev 1 |
2026-03-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.fauxmacho .com domain |
rev 1 |
2026-03-09 |
| snort |
ET CURRENT_EVENTS Coruna Device Fingerprinting M1 |
rev 1 |
2026-03-09 |
| snort |
ET TROJAN Observed MeshCentral RMM Admin Panel |
rev 1 |
2026-03-09 |
| snort |
ET CURRENT_EVENTS Coruna Device Fingerprinting M2 |
rev 1 |
2026-03-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.fauxmacho .com domain |
rev 1 |
2026-03-09 |
| snort |
ET CURRENT_EVENTS Coruna Device Fingerprinting M5 |
rev 1 |
2026-03-09 |
| snort |
ET CURRENT_EVENTS Coruna Device Fingerprinting M3 |
rev 1 |
2026-03-09 |
| suricata |
ET EXPLOIT_KIT Coruna Device Fingerprinting M5 |
rev 1 |
2026-03-09 |
| suricata |
ET EXPLOIT_KIT Coruna Device Fingerprinting M4 |
rev 1 |
2026-03-09 |
| suricata |
ET EXPLOIT_KIT Coruna Device Fingerprinting M1 |
rev 1 |
2026-03-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.fauxmacho .com domain |
rev 1 |
2026-03-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.fauxmacho .com domain |
rev 1 |
2026-03-09 |
| suricata |
ET MALWARE Observed MeshCentral RMM Admin Panel |
rev 1 |
2026-03-09 |
| suricata |
ET EXPLOIT_KIT Coruna Device Fingerprinting M3 |
rev 1 |
2026-03-09 |
| suricata |
ET EXPLOIT_KIT Coruna Device Fingerprinting M2 |
rev 1 |
2026-03-09 |
| sigma |
Python One-Liners with Base64 Decoding |
experimental |
2026-03-09 |
| sigma |
Python One-Liners with Base64 Decoding - Linux |
experimental |
2026-03-09 |
| sigma |
Github Delete Action Invoked |
test |
2026-03-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hndifhidalgo .gob .mx domain |
rev 1 |
2026-03-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.lauriemillotte .com domain |
rev 1 |
2026-03-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.lauriemillotte .com domain |
rev 1 |
2026-03-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hndifhidalgo .gob .mx domain |
rev 1 |
2026-03-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hndifhidalgo .gob .mx domain |
rev 1 |
2026-03-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hndifhidalgo .gob .mx domain |
rev 1 |
2026-03-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.lauriemillotte .com domain |
rev 1 |
2026-03-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.lauriemillotte .com domain |
rev 1 |
2026-03-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.christianfaure .com domain |
rev 1 |
2026-03-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.christianfaure .com domain |
rev 1 |
2026-03-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.christianfaure .com domain |
rev 1 |
2026-03-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.christianfaure .com domain |
rev 1 |
2026-03-07 |
| snort |
ET TROJAN DefendNot Installer Script Inbound |
rev 1 |
2026-03-06 |