| sigma |
Windows AMSI Related Registry Tampering Via CommandLine |
experimental |
2025-12-25 |
| snort |
ET TROJAN GachiLoader Staging HTTP Request |
rev 1 |
2025-12-23 |
| suricata |
ET MALWARE GachiLoader Staging HTTP Request |
rev 1 |
2025-12-23 |
| snort |
ET TROJAN Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| suricata |
ET MALWARE Win.Supper Tunnel C2 Magic Bytes Detected |
rev 1 |
2025-12-22 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M2 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT C Variant Malware Outbound Request To IP Geo Location Service ip-api M3 |
rev 1 |
2025-12-19 |
| suricata |
ET MALWARE Possible CastleRAT Python Malware Outbound Request To IP Geo Location Service ip-api |
rev 1 |
2025-12-19 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M9 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M8 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M6 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE ZeitLoader Payload Retrieval attempt |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M3 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M5 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M2 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M4 |
rev 1 |
2025-12-18 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake M7 |
rev 1 |
2025-12-18 |
| snort |
ET TROJAN CastleLoader Malware Outbound Payload Request |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Inbound Command Retrieval via Finger Service |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleLoader Malware Stager Outbound Payload Request |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN CastleRAT Malware Outbound Handshake |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleRAT Malware Outbound Handshake |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Stager Outbound Payload Request |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Outbound Payload Request |
rev 1 |
2025-12-17 |
| suricata |
ET MALWARE CastleLoader Malware Inbound Command Retrieval via Finger Service |
rev 1 |
2025-12-17 |
| snort |
ET TROJAN SantaStealer Data Exfiltration Attempt |
rev 1 |
2025-12-16 |