| sigma |
Change PowerShell Policies to an Insecure Level |
test |
2025-10-07 |
| sigma |
HackTool - LaZagne Execution |
experimental |
2025-10-07 |
| sigma |
PowerShell Module File Created By Non-PowerShell Process |
test |
2025-10-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.caribdeals .com domain |
rev 1 |
2025-10-06 |
| sigma |
New RUN Key Pointing to Suspicious Folder |
experimental |
2025-10-06 |
| sigma |
Potential DLL Sideloading Of DBGCORE.DLL |
test |
2025-10-06 |
| sigma |
Potential JLI.dll Side-Loading |
experimental |
2025-10-06 |
| sigma |
Suspicious Eventlog Clear |
test |
2025-10-06 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M5 |
rev 1 |
2025-10-03 |
| snort |
ET TROJAN Oyster Backdoor CnC Checkin M6 |
rev 1 |
2025-10-03 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M6 |
rev 1 |
2025-10-03 |
| suricata |
ET MALWARE Oyster Backdoor CnC Checkin M5 |
rev 1 |
2025-10-03 |
| snort |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| suricata |
ET ATTACK_RESPONSE Braodo Loader Inbound |
rev 1 |
2025-10-02 |
| sigma |
Linux Sudo Chroot Execution |
experimental |
2025-10-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.maderasrm .cl domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.giripawan .com .np domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mukeshbasnet .com .np domain |
rev 1 |
2025-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.einfach-du .ch domain |
rev 1 |
2025-10-01 |
| snort |
ET INFO WebDAV Retrieving .ps1 |
rev 1 |
2025-09-30 |
| suricata |
ET HUNTING WebDAV Retrieving .ps1 |
rev 1 |
2025-09-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hbplw .ch domain |
rev 1 |
2025-09-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mattlucas .info domain |
rev 1 |
2025-09-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.waser-consulting .ch domain |
rev 1 |
2025-09-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.martindonnelly .com .au domain |
rev 1 |
2025-09-29 |