| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.chem101 .com domain |
rev 1 |
2026-01-12 |
| suricata |
ET MALWARE GhostPenguin C2 Beacon Observed |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jo3 .org domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.2bd .net domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.railway .web .id domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.generaloweb .com domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.anjumanallana .in domain |
rev 1 |
2026-01-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.eminescusm .ro domain |
rev 1 |
2026-01-12 |
| snort |
ET TROJAN DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT CnC Welcome Message |
rev 1 |
2026-01-09 |
| snort |
ET TROJAN DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| snort |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT CnC HeartBeat Request |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT CnC Welcome Message |
rev 1 |
2026-01-09 |
| suricata |
ET ATTACK_RESPONSE GETA RAT Obfuscated Payload Inbound |
rev 1 |
2026-01-09 |
| suricata |
ET MALWARE DeskRAT Victim HeartBeat Response |
rev 1 |
2026-01-09 |
| sigma |
Office Macro File Creation |
test |
2026-01-09 |
| sigma |
HackTool - WSASS Execution |
experimental |
2026-01-09 |
| sigma |
Outlook Security Settings Updated - Registry |
test |
2026-01-09 |
| sigma |
System Language Discovery via Reg.Exe |
experimental |
2026-01-09 |
| sigma |
Suspicious Msiexec Execute Arbitrary DLL |
test |
2026-01-09 |
| sigma |
Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location |
experimental |
2026-01-09 |
| sigma |
Potential Persistence Via Visual Studio Tools for Office |
test |
2026-01-09 |
| sigma |
WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze |
experimental |
2026-01-09 |
| sigma |
Suspicious Creation TXT File in User Desktop |
test |
2026-01-09 |
| sigma |
Inbox Rules Creation Or Update Activity in O365 |
experimental |
2026-01-09 |
| snort |
ET TROJAN MaskGramStealer CnC initial Victim Checkin |
rev 1 |
2026-01-08 |
| snort |
ET TROJAN WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| suricata |
ET MALWARE MaskGramStealer CnC initial Victim Checkin |
rev 1 |
2026-01-08 |
| suricata |
ET MALWARE WeyhroC2 Heartbeat |
rev 1 |
2026-01-08 |
| sigma |
Shell Invocation via Env Command - Linux |
test |
2026-01-08 |
| snort |
ET WEB_SPECIFIC_APPS VStarcam get_online_log.cgi Information Disclosure Attempt |
rev 1 |
2026-01-07 |
| suricata |
ET WEB_SPECIFIC_APPS VStarcam get_online_log.cgi Information Disclosure Attempt |
rev 1 |
2026-01-07 |
| sigma |
Service Reconnaissance Via Wmic.EXE |
test |
2026-01-07 |
| snort |
ET TROJAN Lumma Stealer Victim Fingerprinting Activity |
rev 1 |
2026-01-06 |
| snort |
ET CURRENT_EVENTS GhostFrame Request for Blob 2026-01-05 |
rev 1 |
2026-01-06 |
| snort |
ET CURRENT_EVENTS GhostFrame Phish Server Checkin M1 |
rev 1 |
2026-01-06 |
| snort |
ET CURRENT_EVENTS GhostFrame Phish Landing Page M1 2026-01-06 |
rev 1 |
2026-01-06 |
| snort |
ET CURRENT_EVENTS GhostFrame Phish Landing Page M3 2026-01-05 |
rev 1 |
2026-01-06 |
| snort |
ET CURRENT_EVENTS GhostFrame Phish Server Checkin M2 |
rev 1 |
2026-01-06 |