| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.fizicamedicala .ro domain |
rev 1 |
2025-11-20 |
| suricata |
ET INFO Observed DNS Query to .cfd TLD |
rev 1 |
2025-11-20 |
| sigma |
Cisco ASA Exploitation Activity - Proxy |
experimental |
2025-11-20 |
| snort |
ET TROJAN WallStealer CnC Response M2 |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Response M3 |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Checkin - System Information |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer CnC Response M1 |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer Data Exfiltration Attempt |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Checkin - Data Exfiltration |
rev 1 |
2025-11-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN Arkanix Stealer CnC Checkin |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Response M1 |
rev 1 |
2025-11-19 |
| snort |
ET TROJAN WallStealer CnC Checkin - get_dll Request |
rev 1 |
2025-11-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M3 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M2 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - System Information |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE Arkanix Stealer Data Exfiltration Attempt |
rev 1 |
2025-11-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE Arkanix Stealer CnC Checkin |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE Arkanix Stealer CnC Response M1 |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - get_dll Request |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Checkin - Data Exfiltration |
rev 1 |
2025-11-19 |
| suricata |
ET MALWARE WallStealer CnC Response M1 |
rev 1 |
2025-11-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.linuxoz .net domain |
rev 1 |
2025-11-19 |
| sigma |
Network Connection Initiated via Finger.EXE |
experimental |
2025-11-19 |
| sigma |
FileFix - Command Evidence in TypedPaths |
experimental |
2025-11-19 |
| sigma |
Suspicious ClickFix/FileFix Execution Pattern |
experimental |
2025-11-19 |
| sigma |
Potential ClickFix Execution Pattern - Registry |
experimental |
2025-11-19 |
| sigma |
DNS Query by Finger Utility |
experimental |
2025-11-19 |
| snort |
ET TROJAN SilentSync-RAT CnC file tasking request |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT Tasking request |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT CNC Checkin |
rev 1 |
2025-11-18 |
| snort |
ET TROJAN SilentSync-RAT CnC Tasking response |
rev 1 |
2025-11-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT CnC file tasking request |
rev 1 |
2025-11-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.wroth .org domain |
rev 1 |
2025-11-18 |