| snort |
ET INFO DYNAMIC_DNS Query to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| snort |
ET TROJAN EtherHiding Exfil M1 |
rev 1 |
2025-10-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| snort |
ET CURRENT_EVENTS Observed UNK_SmudgedSerpent Style URI |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain |
rev 1 |
2025-10-27 |
| suricata |
ET MALWARE EtherHiding Exfil M1 |
rev 1 |
2025-10-27 |
| suricata |
ET PHISHING Observed UNK_SmudgedSerpent Style URI |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.freeddns .me domain |
rev 1 |
2025-10-27 |
| sigma |
File Download From Browser Process Via Inline URL |
test |
2025-10-27 |
| sigma |
Tor Client/Browser Execution |
test |
2025-10-27 |
| sigma |
Potential Persistence Via New AMSI Providers - Registry |
test |
2025-10-26 |
| sigma |
PUA - Sysinternal Tool Execution - Registry |
test |
2025-10-26 |
| sigma |
Potential COM Object Hijacking Via TreatAs Subkey - Registry |
test |
2025-10-26 |
| sigma |
Potential Persistence Via Logon Scripts - Registry |
test |
2025-10-26 |
| sigma |
PUA - Sysinternals Tools Execution - Registry |
test |
2025-10-26 |
| sigma |
Cred Dump Tools Dropped Files |
test |
2025-10-25 |
| sigma |
System Information Discovery via Registry Queries |
experimental |
2025-10-25 |
| sigma |
Removal Of SD Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| sigma |
Removal Of Index Value to Hide Schedule Task - Registry |
test |
2025-10-25 |
| snort |
ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-10-24 |
| snort |
ET TROJAN Valkyrie Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-10-24 |
| snort |
ET TROJAN Shark Stealer CnC Checkin |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Shark Stealer CnC Checkin |
rev 1 |
2025-10-24 |
| suricata |
ET MALWARE Valkyrie Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-10-24 |
| sigma |
PUA - AdFind Suspicious Execution |
test |
2025-10-24 |
| snort |
ET CURRENT_EVENTS TyKit CnC Request M1 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit Exfil M2 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET TROJAN Phantom Captcha Fake Chrome User-Agent Observed |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit CnC Request M2 2025-10-23 |
rev 1 |
2025-10-23 |
| snort |
ET CURRENT_EVENTS TyKit Exfil M1 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit CnC Request M1 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit CnC Request M2 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit Exfil M1 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET PHISHING TyKit Exfil M2 2025-10-23 |
rev 1 |
2025-10-23 |
| suricata |
ET MALWARE Phantom Captcha Fake Chrome User-Agent Observed |
rev 1 |
2025-10-23 |