| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mikealesso .com domain |
rev 1 |
2025-08-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.itleague .com domain |
rev 1 |
2025-08-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.unowel .com domain |
rev 1 |
2025-08-08 |
| sigma |
FunkLocker Ransomware File Creation |
experimental |
2025-08-08 |
| snort |
ET TROJAN TinyLoader CnC Response M2 |
rev 1 |
2025-08-07 |
| snort |
ET TROJAN TinyLoader CnC Response M1 |
rev 1 |
2025-08-07 |
| suricata |
ET MALWARE TinyLoader CnC Response M1 |
rev 1 |
2025-08-07 |
| suricata |
ET MALWARE TinyLoader CnC Response M2 |
rev 1 |
2025-08-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| snort |
ET CURRENT_EVENTS Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| suricata |
ET EXPLOIT_KIT Observed ClickFix Webpage Inbound |
rev 1 |
2025-08-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ozium1 .org domain |
rev 1 |
2025-08-06 |
| suricata |
ET WEB_SPECIFIC_APPS ABB Cylon Aspect Guest login Privilege Escalation M1 |
rev 1 |
2025-08-05 |
| suricata |
ET WEB_SPECIFIC_APPS ABB Cylon Aspect Guest login Privilege Escalation M2 |
rev 1 |
2025-08-05 |
| sigma |
Potentially Suspicious Execution From Tmp Folder |
test |
2025-08-05 |
| snort |
ET WEB_SPECIFIC_APPS Ilevia EVE X1 Server dbcheck.php db_log parameter Pre-Auth File Disclosure Attempt |
rev 1 |
2025-08-04 |
| suricata |
ET WEB_SPECIFIC_APPS Ilevia EVE X1 Server dbcheck.php db_log parameter Pre-Auth File Disclosure Attempt |
rev 1 |
2025-08-04 |
| sigma |
Low Reputation Effective Top-Level Domain (eTLD) |
experimental |
2025-08-04 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.clandestina .org domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.meteotodi .it domain |
rev 1 |
2025-08-02 |
| sigma |
Potential Hello-World Scraper Botnet Activity |
experimental |
2025-08-02 |
| snort |
ET TROJAN Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| suricata |
ET MALWARE Storm-2603 AK47C2 HTTP Backdoor CnC Checkin |
rev 1 |
2025-08-01 |
| sigma |
Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) |
experimental |
2025-08-01 |
| snort |
ET TROJAN Observed Kimsuky Domain in TLS SNI |
rev 1 |
2025-07-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |