| suricata |
ET ATTACK_RESPONSE KoiStealer Payload Inbound |
rev 1 |
2025-08-25 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.technova .ro domain |
rev 1 |
2025-08-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dirtchicvt .com domain |
rev 1 |
2025-08-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.technova .ro domain |
rev 1 |
2025-08-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dirtchicvt .com domain |
rev 1 |
2025-08-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.technova .ro domain |
rev 1 |
2025-08-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dirtchicvt .com domain |
rev 1 |
2025-08-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dirtchicvt .com domain |
rev 1 |
2025-08-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.technova .ro domain |
rev 1 |
2025-08-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.amango .org domain |
rev 1 |
2025-08-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.amango .org domain |
rev 1 |
2025-08-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.amango .org domain |
rev 1 |
2025-08-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.amango .org domain |
rev 1 |
2025-08-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.gotoenail .com domain |
rev 1 |
2025-08-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ne-t .org domain |
rev 1 |
2025-08-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.gotoenail .com domain |
rev 1 |
2025-08-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ne-t .org domain |
rev 1 |
2025-08-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ne-t .org domain |
rev 1 |
2025-08-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ne-t .org domain |
rev 1 |
2025-08-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.gotoenail .com domain |
rev 1 |
2025-08-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gotoenail .com domain |
rev 1 |
2025-08-22 |
| sigma |
Suspicious Uninstall of Windows Defender Feature via PowerShell |
experimental |
2025-08-22 |
| sigma |
Suspicious Get Local Groups Information |
test |
2025-08-22 |
| sigma |
Suspicious Get Local Groups Information - PowerShell |
test |
2025-08-22 |
| snort |
ET TROJAN TA450 CnC Responding with Encryption Key/IV |
rev 1 |
2025-08-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cryptellegram .com domain |
rev 1 |
2025-08-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cryptellegram .com domain |
rev 1 |
2025-08-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cryptellegram .com domain |
rev 1 |
2025-08-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cryptellegram .com domain |
rev 1 |
2025-08-21 |
| suricata |
ET MALWARE TA450 CnC Responding with Encryption Key/IV |
rev 1 |
2025-08-21 |
| snort |
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound |
rev 1 |
2025-08-20 |
| suricata |
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound |
rev 1 |
2025-08-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.foreverfine .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bratten .org domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bratten .org domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.lwebber .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.winuklottery .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.foreverfine .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.lwebber .com domain |
rev 1 |
2025-08-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.winuklottery .com domain |
rev 1 |
2025-08-19 |