| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET INFO Redirect to MSP360 Software Download Request M2 |
rev 2 |
2026-02-18 |
| suricata |
ET HUNTING GET MSP360 .exe from AWS |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET HUNTING Download MSP360 Package from PowerShell Gallery |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| suricata |
ET MALWARE Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-18 |
| snort |
ET TROJAN Odyssey Stealer Tasking Request |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN Odyssey Stealer Data Exfiltration Attempt |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN AstarionRAT CnC Checkin |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN Odyssey Stealer CnC Checkin |
rev 1 |
2026-02-17 |
| snort |
ET TROJAN Odyssey Stealer Repeat Request |
rev 1 |
2026-02-17 |
| suricata |
ET MALWARE Odyssey Stealer Repeat Request |
rev 1 |
2026-02-17 |
| suricata |
ET MALWARE AstarionRAT CnC Checkin |
rev 1 |
2026-02-17 |
| suricata |
ET MALWARE Odyssey Stealer Data Exfiltration Attempt |
rev 1 |
2026-02-17 |
| suricata |
ET MALWARE Odyssey Stealer CnC Checkin |
rev 1 |
2026-02-17 |
| suricata |
ET MALWARE Odyssey Stealer Tasking Request |
rev 1 |
2026-02-17 |
| sigma |
WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript |
test |
2026-02-17 |
| sigma |
WScript or CScript Dropper - File |
test |
2026-02-17 |
| sigma |
System Control Panel Item Loaded From Uncommon Location |
test |
2026-02-17 |
| sigma |
Potential Dropper Script Execution Via WScript/CScript/MSHTA |
test |
2026-02-17 |
| sigma |
Potentially Suspicious Powershell Script Execution From Temp Folder |
test |
2026-02-17 |
| sigma |
Script Interpreter Execution From Suspicious Folder |
test |
2026-02-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hotelconsuladoinn .com domain |
rev 1 |
2026-02-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hotelconsuladoinn .com domain |
rev 1 |
2026-02-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hotelconsuladoinn .com domain |
rev 1 |
2026-02-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hotelconsuladoinn .com domain |
rev 1 |
2026-02-14 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-13 |
| snort |
ET INFO Fake Github .com Html Footer |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN MacSync Stage 2 CnC Exfil |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN SHubv2.0 CnC Heartbeat |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN Observed MacOS ClickFix Landing Page |
rev 1 |
2026-02-13 |
| snort |
ET TROJAN MacSync Stage 1 Payload Request |
rev 1 |
2026-02-13 |