| sigma |
Office Application Initiated Network Connection Over Uncommon Ports |
test |
2025-10-17 |
| sigma |
Mask System Power Settings Via Systemctl |
experimental |
2025-10-17 |
| sigma |
Audit Rules Deleted Via Auditctl |
experimental |
2025-10-17 |
| sigma |
File With Uncommon Extension Created By An Office Application |
test |
2025-10-17 |
| sigma |
Account Tampering - Suspicious Failed Logon Reasons |
test |
2025-10-17 |
| sigma |
SMB Create Remote File Admin Share |
test |
2025-10-17 |
| sigma |
Potentially Suspicious Desktop Background Change Via Registry |
test |
2025-10-17 |
| sigma |
Alternate PowerShell Hosts - PowerShell Module |
test |
2025-10-17 |
| sigma |
Potential Executable Run Itself As Sacrificial Process |
experimental |
2025-10-17 |
| sigma |
Suspicious Userinit Child Process |
test |
2025-10-17 |
| sigma |
Suspicious Access to Sensitive File Extensions - Zeek |
test |
2025-10-17 |
| sigma |
Program Executed Using Proxy/Local Command Via SSH.EXE |
test |
2025-10-16 |
| sigma |
Syslog Clearing or Removal Via System Utilities |
test |
2025-10-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.axsetubal .pt domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.barabesta .is domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.finxstudio .fi domain |
rev 1 |
2025-10-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.atamanco .eu domain |
rev 1 |
2025-10-13 |
| sigma |
Potential CVE-2023-23397 Exploitation Attempt - SMB |
test |
2025-10-13 |
| sigma |
FTP Connection Open Attempt Via Winscp CLI |
experimental |
2025-10-12 |
| sigma |
Winscp Execution From Non Standard Folder |
experimental |
2025-10-12 |
| sigma |
Modify System Firewall |
test |
2025-10-12 |
| sigma |
AWS STS GetCallerIdentity Enumeration Via TruffleHog |
experimental |
2025-10-12 |
| sigma |
Suspicious Startup Folder Persistence |
test |
2025-10-12 |
| sigma |
Installation of WSL Kali-Linux |
experimental |
2025-10-10 |
| sigma |
WSL Kali-Linux Usage |
experimental |
2025-10-10 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| snort |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| snort |
ET TROJAN FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |