| sigma |
Potential NetWire RAT Activity - Registry |
test |
2025-11-03 |
| sigma |
Windows MSIX Package Support Framework AI_STUBS Execution |
experimental |
2025-11-03 |
| sigma |
Windows AppX Deployment Full Trust Package Installation |
experimental |
2025-11-03 |
| sigma |
Potential Dtrack RAT Activity |
stable |
2025-11-03 |
| sigma |
Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE |
test |
2025-11-03 |
| sigma |
Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966 |
test |
2025-11-03 |
| sigma |
Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800 |
test |
2025-11-03 |
| sigma |
FortiGate - New Local User Created |
experimental |
2025-11-01 |
| sigma |
FortiGate - User Group Modified |
experimental |
2025-11-01 |
| sigma |
FortiGate - New VPN SSL Web Portal Added |
experimental |
2025-11-01 |
| sigma |
FortiGate - VPN SSL Settings Modified |
experimental |
2025-11-01 |
| sigma |
FortiGate - New Administrator Account Created |
experimental |
2025-11-01 |
| sigma |
Creation of a Local Hidden User Account by Registry |
test |
2025-10-31 |
| sigma |
Capture Credentials with Rpcping.exe |
test |
2025-10-31 |
| sigma |
Wlrmdr.EXE Uncommon Argument Or Child Process |
experimental |
2025-10-31 |
| sigma |
Explorer Process Tree Break |
test |
2025-10-31 |
| sigma |
Exploitation Activity of CVE-2025-59287 - WSUS Suspicious Child Process |
experimental |
2025-10-31 |
| sigma |
Exploitation Activity of CVE-2025-59287 - WSUS Deserialization |
experimental |
2025-10-31 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| snort |
ET EXPLOIT Chrome V8 Shellcode Inject Attempt |
rev 1 |
2025-10-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| suricata |
ET EXPLOIT Chrome V8 Shellcode Inject Attempt |
rev 1 |
2025-10-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain |
rev 1 |
2025-10-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| snort |
ET TROJAN Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| suricata |
ET MALWARE Amadey PowerShell Loader Inbound |
rev 1 |
2025-10-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.3trust .com domain |
rev 1 |
2025-10-29 |
| sigma |
Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| sigma |
Suspicious CertReq Command to Download |
experimental |
2025-10-29 |
| sigma |
Office Macro File Download |
test |
2025-10-29 |
| sigma |
Suspicious CustomShellHost Execution |
test |
2025-10-29 |
| sigma |
MSDT Execution Via Answer File |
test |
2025-10-29 |
| sigma |
Renamed Visual Studio Code Tunnel Execution |
test |
2025-10-29 |
| snort |
ET CURRENT_EVENTS Common Phish Redirect Chain - GCS to divists .us .com |
rev 1 |
2025-10-28 |
| snort |
ET CURRENT_EVENTS Landing Page Victim Registration Validation |
rev 1 |
2025-10-28 |
| suricata |
ET PHISHING Landing Page Victim Registration Validation |
rev 1 |
2025-10-28 |
| suricata |
ET PHISHING Common Phish Redirect Chain - GCS to divists .us .com |
rev 1 |
2025-10-28 |