| sigma |
Suspicious Speech Runtime Binary Child Process |
experimental |
2025-10-23 |
| sigma |
CurrentVersion Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Common Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Classes Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Registry Persistence via Service in Safe Mode |
test |
2025-10-22 |
| sigma |
Scheduled TaskCache Change by Uncommon Program |
test |
2025-10-22 |
| sigma |
Potential Persistence Via Shim Database Modification |
test |
2025-10-22 |
| sigma |
CurrentVersion NT Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Use Short Name Path in Command Line |
test |
2025-10-22 |
| sigma |
Modification of IE Registry Settings |
test |
2025-10-22 |
| sigma |
Potential Lateral Movement via Windows Remote Shell |
experimental |
2025-10-22 |
| sigma |
Winrs Local Command Execution |
experimental |
2025-10-22 |
| sigma |
WMIC Remote Command Execution |
test |
2025-10-22 |
| sigma |
Suspicious Non PowerShell WSMAN COM Provider |
test |
2025-10-22 |
| sigma |
Copy From Or To Admin Share Or Sysvol Folder |
test |
2025-10-22 |
| sigma |
Sysmon Channel Reference Deletion |
test |
2025-10-22 |
| sigma |
Wow6432Node Windows NT CurrentVersion Autorun Keys Modification |
test |
2025-10-22 |
| sigma |
Allow Service Access Using Security Descriptor Tampering Via Sc.EXE |
test |
2025-10-22 |
| sigma |
Scheduled Task Creation Via Schtasks.EXE |
test |
2025-10-22 |
| sigma |
Uncommon PowerShell Hosts |
test |
2025-10-22 |
| sigma |
Potential Ursnif Malware Activity - Registry |
test |
2025-10-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.destroyerkisscover .com .br domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hornburst .com domain |
rev 1 |
2025-10-21 |
| sigma |
PUA - AWS TruffleHog Execution |
experimental |
2025-10-21 |
| sigma |
AWS Successful Console Login Without MFA |
experimental |
2025-10-21 |
| sigma |
Blackbyte Ransomware Registry |
test |
2025-10-21 |
| sigma |
HackTool - Windows Credential Editor (WCE) Execution |
test |
2025-10-21 |
| sigma |
Potentially Suspicious JWT Token Search Via CLI |
test |
2025-10-21 |
| snort |
ET TROJAN GlassWorm Decryption IV/Key Response |
rev 1 |
2025-10-20 |
| suricata |
ET MALWARE GlassWorm Decryption IV/Key Response |
rev 1 |
2025-10-20 |
| sigma |
Local Accounts Discovery |
test |
2025-10-20 |
| sigma |
Usage Of Web Request Commands And Cmdlets |
test |
2025-10-20 |
| sigma |
Use Short Name Path in Image |
test |
2025-10-20 |
| sigma |
PowerShell Download Pattern |
test |
2025-10-20 |