| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.superbrownbear .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.thrilladesign .com domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.suredoc .net domain |
rev 1 |
2025-08-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jandjley .com domain |
rev 1 |
2025-08-29 |
| sigma |
Suspicious Velociraptor Child Process |
experimental |
2025-08-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.paulinhoimoveis .com domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.conyser .cl domain |
rev 1 |
2025-08-28 |
| sigma |
RestrictedAdminMode Registry Value Tampering - ProcCreation |
test |
2025-08-28 |
| snort |
ET TROJAN Possible OwlProxy activity M1 |
rev 2 |
2025-08-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| snort |
ET INFO GitHub Authentication via client_id in HTTP POST |
rev 1 |
2025-08-27 |
| suricata |
ET MALWARE Possible OwlProxy activity M1 |
rev 2 |
2025-08-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| suricata |
ET HUNTING GitHub Authentication via client_id in HTTP POST |
rev 1 |
2025-08-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yodyiam .com domain |
rev 1 |
2025-08-27 |
| sigma |
Suspicious Windows Service Tampering |
test |
2025-08-27 |
| sigma |
Regsvr32 DLL Execution With Suspicious File Extension |
test |
2025-08-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.kalinnikova .com domain |
rev 1 |
2025-08-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.miguelrsilva .com domain |
rev 1 |
2025-08-26 |
| snort |
ET WEB_SPECIFIC_APPS Commvault Code Injection via User description Property |
rev 1 |
2025-08-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.miguelrsilva .com domain |
rev 1 |
2025-08-26 |
| snort |
ET WEB_SPECIFIC_APPS VTENext Session Cookie Information Disclosure via Touch Module |
rev 1 |
2025-08-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.kalinnikova .com domain |
rev 1 |
2025-08-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.kalinnikova .com domain |
rev 1 |
2025-08-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.miguelrsilva .com domain |
rev 1 |
2025-08-26 |
| suricata |
ET WEB_SPECIFIC_APPS Commvault Code Injection via User description Property |
rev 1 |
2025-08-26 |
| suricata |
ET WEB_SPECIFIC_APPS VTENext Session Cookie Information Disclosure via Touch Module |
rev 1 |
2025-08-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.kalinnikova .com domain |
rev 1 |
2025-08-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.miguelrsilva .com domain |
rev 1 |
2025-08-26 |
| snort |
ET ATTACK_RESPONSE KoiStealer Payload Inbound |
rev 1 |
2025-08-25 |
| snort |
ET TROJAN KoiStealer Payload Reqeust |
rev 1 |
2025-08-25 |
| suricata |
ET ATTACK_RESPONSE KoiStealer Payload Inbound |
rev 1 |
2025-08-25 |