| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.carrard .org domain |
rev 1 |
2026-01-31 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.carrard .org domain |
rev 1 |
2026-01-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.carrard .org domain |
rev 1 |
2026-01-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.carrard .org domain |
rev 1 |
2026-01-31 |
| snort |
ET CURRENT_EVENTS Tycoon Landing Page |
rev 7 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Tycoon2FA Phishing Kit Style Evasion |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS [TW] Tycoon Phishkit CSS |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Tycoon 2FA Document Delivery Webpage |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Tycoon Credential Theft Landing Page |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Observed Tycoon Credential Theft Form |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Tycoon 2FA Fake Captcha Check |
rev 2 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS [TW] Tycoon Phishkit Config Vars |
rev 3 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS Tycoon Landing Page |
rev 4 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS CoGUI Phish Landing Page M2 2026-01-29 |
rev 1 |
2026-01-29 |
| snort |
ET CURRENT_EVENTS CoGUI Phish Landing Page M1 2026-01-29 |
rev 1 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon 2FA Document Delivery Webpage |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING [TW] Tycoon Phishkit CSS |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING CoGUI Phish Landing Page M2 2026-01-29 |
rev 1 |
2026-01-29 |
| suricata |
ET PHISHING Observed Tycoon Credential Theft Form |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon Landing Page |
rev 4 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon2FA Phishing Kit Style Evasion |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon 2FA Fake Captcha Check |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING [TW] Tycoon Phishkit Config Vars |
rev 3 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon Credential Theft Landing Page |
rev 2 |
2026-01-29 |
| suricata |
ET PHISHING Tycoon Landing Page |
rev 6 |
2026-01-29 |
| suricata |
ET PHISHING CoGUI Phish Landing Page M1 2026-01-29 |
rev 1 |
2026-01-29 |
| snort |
ET TROJAN Observed ClickFix WebPage Inbound |
rev 1 |
2026-01-27 |
| snort |
ET TROJAN Observed ClickFix WebPage Inbound |
rev 1 |
2026-01-27 |
| suricata |
ET MALWARE Observed ClickFix WebPage Inbound |
rev 1 |
2026-01-27 |
| suricata |
ET MALWARE Observed ClickFix WebPage Inbound |
rev 1 |
2026-01-27 |
| sigma |
Suspicious Email Delivered In Microsoft 365 |
experimental |
2026-01-27 |
| snort |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| snort |
ET INFO NTLMv1 Session Setup Response - Challenge |
rev 1 |
2026-01-26 |
| snort |
ET INFO NTLM Session Setup Request - Auth |
rev 1 |
2026-01-26 |
| snort |
ET INFO NTLM Session Setup Request - Negotiate |
rev 1 |
2026-01-26 |
| snort |
ET INFO Large non-DNS Packet on Port 53 |
rev 1 |
2026-01-26 |
| suricata |
ET INFO Download Request for MSP360 Software |
rev 1 |
2026-01-26 |
| suricata |
ET INFO Redirect to MSP360 Software Download Request M1 |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLM Session Setup Request - Negotiate |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLM Session Setup Request - Auth |
rev 1 |
2026-01-26 |