| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1 |
rev 1 |
2025-10-08 |
| suricata |
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2 |
rev 1 |
2025-10-08 |
| suricata |
ET MALWARE FrigidBackdoor Checkin |
rev 2 |
2025-10-08 |
| sigma |
Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE |
test |
2025-10-08 |
| sigma |
Recon Command Output Piped To Findstr.EXE |
test |
2025-10-08 |
| sigma |
Process Creation Using Sysnative Folder |
test |
2025-10-08 |
| sigma |
Potential Persistence Via Netsh Helper DLL - Registry |
test |
2025-10-08 |
| sigma |
PowerShell Deleted Mounted Share |
test |
2025-10-07 |
| sigma |
Python Inline Command Execution |
test |
2025-10-07 |
| sigma |
Potential Exploitation of GoAnywhere MFT Vulnerability |
experimental |
2025-10-07 |
| sigma |
Potentially Suspicious Windows App Activity |
test |
2025-10-07 |
| sigma |
Potential Suspicious Browser Launch From Document Reader Process |
test |
2025-10-07 |
| sigma |
Potential Antivirus Software DLL Sideloading |
test |
2025-10-07 |
| sigma |
Amsi.DLL Loaded Via LOLBIN Process |
test |
2025-10-07 |
| sigma |
PowerShell Module File Created By Non-PowerShell Process |
test |
2025-10-07 |
| sigma |
Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE |
test |
2025-10-07 |
| sigma |
Internet Explorer DisableFirstRunCustomize Enabled |
test |
2025-10-07 |
| sigma |
Potential PendingFileRenameOperations Tampering |
test |
2025-10-07 |
| sigma |
Process Proxy Execution Via Squirrel.EXE |
test |
2025-10-07 |
| sigma |
Firewall Rule Deleted Via Netsh.EXE |
test |
2025-10-07 |
| sigma |
Unsigned DLL Loaded by Windows Utility |
test |
2025-10-07 |
| sigma |
Verclsid.exe Runs COM Object |
test |
2025-10-07 |
| sigma |
Filter Driver Unloaded Via Fltmc.EXE |
test |
2025-10-07 |
| sigma |
Delete Defender Scan ShellEx Context Menu Registry Key |
experimental |
2025-10-07 |
| sigma |
Change PowerShell Policies to an Insecure Level |
test |
2025-10-07 |
| sigma |
Potential DLL Sideloading Of DBGHELP.DLL |
test |
2025-10-07 |
| sigma |
Potential Goopdate.DLL Sideloading |
test |
2025-10-07 |
| sigma |
Suspicious Msiexec Quiet Install From Remote Location |
test |
2025-10-07 |
| sigma |
Removal of Potential COM Hijacking Registry Keys |
test |
2025-10-07 |
| sigma |
New Kernel Driver Via SC.EXE |
test |
2025-10-07 |
| sigma |
Service Binary in Suspicious Folder |
test |
2025-10-07 |
| sigma |
Alternate PowerShell Hosts Pipe |
test |
2025-10-07 |
| sigma |
Powershell Create Scheduled Task |
test |
2025-10-07 |
| sigma |
Windows Binaries Write Suspicious Extensions |
test |
2025-10-07 |
| sigma |
Removal Of AMSI Provider Registry Keys |
test |
2025-10-07 |
| sigma |
File Download with Headless Browser |
test |
2025-10-07 |
| sigma |
HackTool - LaZagne Execution |
experimental |
2025-10-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |