| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sismonda .com .ar domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dstand .com .au domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.betertech .com .ar domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.petterisaak .com domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thesqueakandoilmanual .com domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thesqueakandoilchart .com domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.thesqueakandoilchart .com domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.petterisaak .com domain |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Quad7 Botnet - Outbound rlogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| suricata |
ET MALWARE Quad7 Botnet - Outbound alogin Telnet Prompt from Compromised Endpoint |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mygadgets .com .ar domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mygadgets .com .ar domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.betertech .com .ar domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.avtoservis-hladin .si domain |
rev 1 |
2025-09-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dicosmo .com .au domain |
rev 1 |
2025-09-04 |
| snort |
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound |
rev 1 |
2025-09-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.australianhuntermag .com domain |
rev 1 |
2025-09-02 |
| snort |
ET TROJAN GET Request to steamcommunity .com With Minimal Headers - Common With InfoStealers |
rev 5 |
2025-09-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.australianhuntermag .com domain |
rev 1 |
2025-09-02 |
| snort |
ET TROJAN GCleaner Loader CnC Server Response |
rev 1 |
2025-09-02 |
| suricata |
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound |
rev 1 |
2025-09-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.australianhuntermag .com domain |
rev 1 |
2025-09-02 |
| suricata |
ET MALWARE GCleaner Loader CnC Server Response |
rev 1 |
2025-09-02 |
| suricata |
ET MALWARE GET Request to steamcommunity .com With Minimal Headers - Common With InfoStealers |
rev 5 |
2025-09-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.australianhuntermag .com domain |
rev 1 |
2025-09-02 |
| sigma |
IIS WebServer Log Deletion via CommandLine Utilities |
experimental |
2025-09-02 |
| sigma |
New Service Creation Using Sc.EXE |
test |
2025-09-01 |
| sigma |
Potential PsExec Remote Execution |
test |
2025-09-01 |
| sigma |
Potential Persistence Via Notepad++ Plugins |
test |
2025-09-01 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |