| suricata |
ET PHISHING GhostFrame Phish Landing Page M1 2026-01-06 |
rev 1 |
2026-01-06 |
| suricata |
ET MALWARE Lumma Stealer Victim Fingerprinting Activity |
rev 1 |
2026-01-06 |
| suricata |
ET PHISHING GhostFrame Request for Blob 2026-01-05 |
rev 1 |
2026-01-06 |
| suricata |
ET PHISHING GhostFrame Phish Server Checkin M1 |
rev 1 |
2026-01-06 |
| suricata |
ET PHISHING GhostFrame Phish Server Checkin M2 |
rev 1 |
2026-01-06 |
| suricata |
ET PHISHING GhostFrame Phish Landing Page M3 2026-01-05 |
rev 1 |
2026-01-06 |
| sigma |
OpenCanary - NMAP NULL Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - RDP New Connection Attempt |
experimental |
2026-01-06 |
| sigma |
OpenCanary - Host Port Scan (SYN Scan) |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP XMAS Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP OS Scan |
experimental |
2026-01-06 |
| sigma |
OpenCanary - NMAP FIN Scan |
experimental |
2026-01-06 |
| sigma |
Modify User Shell Folders Startup Value |
test |
2026-01-05 |
| sigma |
Direct Autorun Keys Modification |
test |
2026-01-05 |
| sigma |
User Shell Folders Registry Modification via CommandLine |
experimental |
2026-01-05 |
| sigma |
Devcon Execution Disabling VMware VMCI Device |
experimental |
2026-01-02 |
| sigma |
PUA - Kernel Driver Utility (KDU) Execution |
experimental |
2026-01-02 |
| sigma |
Suspicious Package Installed - Linux |
test |
2026-01-01 |
| snort |
ET EXPLOIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| snort |
ET EXPLOIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| suricata |
ET EXPLOIT_KIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| suricata |
ET EXPLOIT_KIT ClickFix Payload Delivery Page Observed |
rev 1 |
2025-12-31 |
| snort |
ET INFO MongoDB SASL Authentication Detected |
rev 1 |
2025-12-29 |
| suricata |
ET INFO MongoDB SASL Authentication Detected |
rev 1 |
2025-12-29 |
| snort |
ET TROJAN Observed XWorm Payload Delivery Domain in TLS SNI |
rev 1 |
2025-12-26 |
| snort |
ET TROJAN Observed DNS Query to XWorm Payload Delivery Domain |
rev 1 |
2025-12-26 |
| snort |
ET TROJAN Observed DNS Query to XWorm Payload Delivery Domain |
rev 1 |
2025-12-26 |
| snort |
ET TROJAN Observed XWorm Payload Delivery Domain in TLS SNI |
rev 1 |
2025-12-26 |
| snort |
ET ATTACK_RESPONSE JScriptToPowerShell Obfuscator Payload Inbound |
rev 1 |
2025-12-26 |
| suricata |
ET MALWARE Observed XWorm Payload Delivery Domain in TLS SNI |
rev 1 |
2025-12-26 |
| suricata |
ET MALWARE Observed DNS Query to XWorm Payload Delivery Domain |
rev 1 |
2025-12-26 |
| suricata |
ET MALWARE Observed DNS Query to XWorm Payload Delivery Domain |
rev 1 |
2025-12-26 |
| suricata |
ET ATTACK_RESPONSE JScriptToPowerShell Obfuscator Payload Inbound |
rev 1 |
2025-12-26 |
| suricata |
ET MALWARE Observed XWorm Payload Delivery Domain in TLS SNI |
rev 1 |
2025-12-26 |
| sigma |
Windows Credential Guard Related Registry Value Deleted - Registry |
experimental |
2025-12-26 |
| sigma |
Windows Credential Guard Disabled - Registry |
experimental |
2025-12-26 |
| sigma |
Potential AutoLogger Sessions Tampering |
test |
2025-12-26 |
| sigma |
Windows Credential Guard Registry Tampering Via CommandLine |
experimental |
2025-12-26 |
| sigma |
Windows EventLog Autologger Session Registry Modification Via CommandLine |
experimental |
2025-12-25 |
| sigma |
Windows AMSI Related Registry Tampering Via CommandLine |
experimental |
2025-12-25 |