| sigma |
System Info Discovery via Sysinfo Syscall |
experimental |
2025-12-05 |
| sigma |
Special File Creation via Mknod Syscall |
experimental |
2025-12-05 |
| sigma |
HTML File Opened From Download Folder |
experimental |
2025-12-05 |
| sigma |
Windows Suspicious Child Process from Node.js - React2Shell |
experimental |
2025-12-05 |
| sigma |
Linux Suspicious Child Process from Node.js - React2Shell |
experimental |
2025-12-05 |
| sigma |
Potential Defense Evasion Via Raw Disk Access By Uncommon Tools |
test |
2025-12-03 |
| sigma |
AppX Package Deployment Failed Due to Signing Requirements |
test |
2025-12-03 |
| sigma |
Unauthorized System Time Modification |
test |
2025-12-03 |
| sigma |
LSASS Process Crashed - Application |
experimental |
2025-12-03 |
| sigma |
AppX Located in Uncommon Directory Added to Deployment Pipeline |
test |
2025-12-03 |
| sigma |
Startup Folder File Write |
test |
2025-12-03 |
| sigma |
AppLocker Prevented Application or Script from Running |
test |
2025-12-03 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bostoncareercounselor .com domain |
rev 1 |
2025-12-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.coaching2lead .com domain |
rev 1 |
2025-12-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.coaching2lead .com domain |
rev 1 |
2025-12-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bostoncareercounselor .com domain |
rev 1 |
2025-12-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bostoncareercounselor .com domain |
rev 1 |
2025-12-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.coaching2lead .com domain |
rev 1 |
2025-12-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.coaching2lead .com domain |
rev 1 |
2025-12-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bostoncareercounselor .com domain |
rev 1 |
2025-12-02 |
| sigma |
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities |
test |
2025-12-02 |
| sigma |
Suspicious File Downloaded From Direct IP Via Certutil.EXE |
test |
2025-12-01 |
| sigma |
Suspicious Download Via Certutil.EXE |
test |
2025-12-01 |
| sigma |
Github Self-Hosted Runner Execution |
test |
2025-11-29 |
| sigma |
Shai-Hulud 2.0 Malicious NPM Package Installation |
experimental |
2025-11-28 |
| sigma |
Shai-Hulud 2.0 Malicious NPM Package Installation - Linux |
experimental |
2025-11-28 |
| sigma |
LOL-Binary Copied From System Directory |
test |
2025-11-27 |
| sigma |
Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze |
experimental |
2025-11-27 |
| sigma |
Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs |
experimental |
2025-11-27 |
| sigma |
Hacktool - EDR-Freeze Execution |
experimental |
2025-11-27 |
| sigma |
AWS GuardDuty Detector Deleted Or Updated |
experimental |
2025-11-27 |
| snort |
ET CURRENT_EVENTS Common Credential Theft Redirect Page |
rev 1 |
2025-11-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| suricata |
ET PHISHING Common Credential Theft Redirect Page |
rev 1 |
2025-11-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.tuev-nord .hk domain |
rev 1 |
2025-11-26 |
| sigma |
Grixba Malware Reconnaissance Activity |
experimental |
2025-11-26 |
| sigma |
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix |
experimental |
2025-11-26 |
| snort |
ET CURRENT_EVENTS Mirai Variant Payload Inbound |
rev 1 |
2025-11-25 |