| snort |
ET TROJAN WallStealer Data Exfiltration Attempt over Telegram |
rev 1 |
2025-11-25 |
| snort |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| snort |
ET CURRENT_EVENTS RondoDox BotNet Init Script Inbound |
rev 1 |
2025-11-25 |
| suricata |
ET MALWARE WallStealer Data Exfiltration Attempt over Telegram |
rev 1 |
2025-11-25 |
| suricata |
ET EXPLOIT_KIT RondoDox BotNet Init Script Inbound |
rev 1 |
2025-11-25 |
| suricata |
ET EXPLOIT_KIT Mirai Variant Payload Inbound |
rev 1 |
2025-11-25 |
| suricata |
ET WEB_SPECIFIC_APPS N-able N-central Session ID Disclosure |
rev 1 |
2025-11-25 |
| sigma |
Suspicious ArcSOC.exe Child Process |
experimental |
2025-11-25 |
| sigma |
Script Interpreter Spawning Credential Scanner - Windows |
experimental |
2025-11-25 |
| sigma |
Suspicious File Created by ArcSOC.exe |
experimental |
2025-11-25 |
| sigma |
Script Interpreter Spawning Credential Scanner - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malware Indicators - Windows |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malware Indicators - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malicious Bun Execution - Linux |
experimental |
2025-11-25 |
| sigma |
Shai-Hulud Malicious Bun Execution |
experimental |
2025-11-25 |
| snort |
ET INFO POST Request to .cfd Domain |
rev 1 |
2025-11-24 |
| suricata |
ET HUNTING POST Request to .cfd Domain |
rev 1 |
2025-11-24 |
| sigma |
Suspicious FileFix Execution Pattern |
experimental |
2025-11-24 |
| sigma |
Potential Container Discovery Via Inodes Listing |
test |
2025-11-24 |
| sigma |
PPL Tampering Via WerFaultSecure |
experimental |
2025-11-23 |
| sigma |
RDP Sensitive Settings Changed |
test |
2025-11-22 |
| sigma |
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection |
test |
2025-11-22 |
| sigma |
Potentially Suspicious Long Filename Pattern - Linux |
experimental |
2025-11-22 |
| sigma |
Potential Tampering With RDP Related Registry Keys Via Reg.EXE |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification via GPME |
experimental |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - Persistence Indicators |
experimental |
2025-11-22 |
| sigma |
Atomic MacOS Stealer - FileGrabber Activity |
experimental |
2025-11-22 |
| sigma |
Suspicious Filename with Embedded Base64 Commands |
experimental |
2025-11-22 |
| sigma |
JexBoss Command Sequence |
test |
2025-11-22 |
| sigma |
Windows Default Domain GPO Modification |
experimental |
2025-11-22 |
| snort |
ET INFO Observed request to common DOH pattern in URI M1 |
rev 1 |
2025-11-21 |
| snort |
ET INFO Observed HTTP Content-Type Common to DoH Services |
rev 1 |
2025-11-21 |
| suricata |
ET INFO Observed request to common DOH pattern in URI M1 |
rev 1 |
2025-11-21 |
| suricata |
ET INFO Observed HTTP Content-Type Common to DoH Services |
rev 1 |
2025-11-21 |
| elastic |
Deprecated - AWS Root Login Without MFA |
deprecated |
2025-11-21 |
| snort |
ET INFO Observed DNS Query to .cfd TLD |
rev 1 |
2025-11-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| snort |
ET TROJAN OtterCookie File Exfiltration M2 |
rev 1 |
2025-11-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| suricata |
ET MALWARE OtterCookie File Exfiltration M2 |
rev 1 |
2025-11-20 |