| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.redecasas .com domain |
rev 1 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.vinoniv .com domain |
rev 1 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dufwa .org domain |
rev 1 |
2025-07-24 |
| snort |
ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M4 |
rev 2 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.redecasas .com domain |
rev 1 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.sachhot .com domain |
rev 1 |
2025-07-24 |
| snort |
ET INFO Default PolarSSL/mbedTLS Certificate Subject Observed in Certificate |
rev 1 |
2025-07-24 |
| snort |
ET INFO ISLOnline RMM Installer Activity |
rev 1 |
2025-07-24 |
| snort |
ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M2 |
rev 1 |
2025-07-24 |
| snort |
ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M2 |
rev 2 |
2025-07-24 |
| snort |
ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M3 |
rev 2 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.sachhot .com domain |
rev 1 |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.vinoniv .com domain |
rev 1 |
2025-07-24 |
| snort |
ET TROJAN Observed Malicious SSL Cert Associated with PolarEdge Botnet M1 |
rev 2 |
2025-07-24 |
| suricata |
ET INFO Default PolarSSL/mbedTLS Certificate Subject Observed in Certificate |
rev 1 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.redecasas .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dufwa .org domain |
rev 1 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.redecasas .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M4 |
rev 2 |
2025-07-24 |
| suricata |
ET MALWARE Possible APT29 CozyBear/SeaDaddy SSL/TLS Certificate Observed |
rev 5 |
2025-07-24 |
| suricata |
ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M1 |
rev 2 |
2025-07-24 |
| suricata |
ET MALWARE Possible DarkTequila SSL/TLS Certificate Observed |
rev 3 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.sachhot .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.sachhot .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.vinoniv .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M2 |
rev 2 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dufwa .org domain |
rev 1 |
2025-07-24 |
| suricata |
ET MALWARE Observed Malicious SSL Cert Associated with PolarEdge Botnet M3 |
rev 2 |
2025-07-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.vinoniv .com domain |
rev 1 |
2025-07-24 |
| suricata |
ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M2 |
rev 1 |
2025-07-24 |
| suricata |
ET INFO ISLOnline RMM Installer Activity |
rev 1 |
2025-07-24 |
| sigma |
Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create |
experimental |
2025-07-24 |
| sigma |
Suspicious File Write to SharePoint Layouts Directory |
experimental |
2025-07-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.hannahdvm .com domain |
rev 1 |
2025-07-23 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.hannahdvm .com domain |
rev 1 |
2025-07-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.hannahdvm .com domain |
rev 1 |
2025-07-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.hannahdvm .com domain |
rev 1 |
2025-07-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.botar .co .uk domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.zmurk .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.aistis .com domain |
rev 1 |
2025-07-22 |