| snort |
ET INFO DYNAMIC_DNS Query to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Kimsuky CnC AppKey Deletion Request |
rev 1 |
2025-07-31 |
| snort |
ET TROJAN Kimsuky CnC Domain in DNS Lookup |
rev 1 |
2025-07-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC AppKey Deletion Request |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Observed Kimsuky Domain in TLS SNI |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC Domain in DNS Lookup |
rev 1 |
2025-07-31 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.trionyx-sal .com domain |
rev 1 |
2025-07-31 |
| suricata |
ET MALWARE Kimsuky CnC AppKey Request |
rev 1 |
2025-07-31 |
| sigma |
Windows Recovery Environment Disabled Via Reagentc |
experimental |
2025-07-31 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.npflifang .com domain |
rev 1 |
2025-07-30 |
| sigma |
Password Set to Never Expire via WMI |
experimental |
2025-07-30 |
| sigma |
Process Initiated Network Connection To Ngrok Domain |
test |
2025-07-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.chucktam .com domain |
rev 1 |
2025-07-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.olivercressey .co .uk domain |
rev 1 |
2025-07-29 |
| sigma |
Virtualbox Driver Installation or Starting of VMs |
test |
2025-07-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cthchile .com domain |
rev 1 |
2025-07-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.118iranian .com domain |
rev 1 |
2025-07-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.osistemas .com domain |
rev 1 |
2025-07-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.osistemas .com domain |
rev 1 |
2025-07-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.osistemas .com domain |
rev 1 |
2025-07-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.osistemas .com domain |
rev 1 |
2025-07-25 |
| snort |
ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M2 |
rev 2 |
2025-07-24 |
| snort |
ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M2 |
rev 1 |
2025-07-24 |