| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| suricata |
ET MALWARE SilentSync-RAT CNC Checkin |
rev 1 |
2025-11-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.wroth .org domain |
rev 1 |
2025-11-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.alltricities .com domain |
rev 1 |
2025-11-15 |
| sigma |
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class |
experimental |
2025-11-15 |
| sigma |
Potentially Suspicious NTFS Symlink Behavior Modification |
test |
2025-11-13 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| snort |
ET TROJAN TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2 |
rev 2 |
2025-11-12 |
| suricata |
ET PHISHING Roblox Phish Redirect 2025-11-12 |
rev 1 |
2025-11-12 |
| suricata |
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results |
rev 2 |
2025-11-12 |
| sigma |
Suspicious Usage of For Loop with Recursive Directory Search in CMD |
experimental |
2025-11-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itfiredup .com domain |
rev 1 |
2025-11-11 |
| sigma |
COM Object Hijacking Via Modification Of Default System CLSID Default Value |
experimental |
2025-11-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.familiawhite .com .ar domain |
rev 1 |
2025-11-08 |
| snort |
ET TROJAN LeakyStealer CnC Checkin |
rev 1 |
2025-11-07 |
| suricata |
ET MALWARE LeakyStealer CnC Checkin |
rev 1 |
2025-11-07 |
| snort |
ET TROJAN MEOWBACKCONN CnC Checkin - Server Response |
rev 1 |
2025-11-04 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| snort |
ET TROJAN Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| suricata |
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response |
rev 1 |
2025-11-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.freeddns .tokyo domain |
rev 1 |
2025-11-04 |
| suricata |
ET MALWARE Observed VBScript Payload Downloader Inbound |
rev 1 |
2025-11-04 |
| sigma |
Suspicious Space Characters in RunMRU Registry Path - ClickFix |
experimental |
2025-11-04 |
| sigma |
Suspicious Space Characters in TypedPaths Registry Path - FileFix |
experimental |
2025-11-04 |
| sigma |
Possible PrintNightmare Print Driver Install - CVE-2021-1675 |
stable |
2025-11-03 |
| sigma |
Successful MSIX/AppX Package Installation |
experimental |
2025-11-03 |
| sigma |
Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE |
test |
2025-11-03 |
| sigma |
OMIGOD HTTP No Authentication RCE - CVE-2021-38647 |
stable |
2025-11-03 |