| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.zmurk .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.socialnomad .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.tedbuy .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.aistis .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.socialnomad .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bellyfatcat .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.aedifice .net domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.zmurk .com domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.aedifice .net domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.botar .co .uk domain |
rev 1 |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bellyfatcat .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tedbuy .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.botar .co .uk domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.socialnomad .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bellyfatcat .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.tedbuy .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.aistis .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.aedifice .net domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.zmurk .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.zmurk .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bellyfatcat .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.botar .co .uk domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.aedifice .net domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.aistis .com domain |
rev 1 |
2025-07-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.socialnomad .com domain |
rev 1 |
2025-07-22 |
| sigma |
Suspicious File Created in Outlook Temporary Directory |
experimental |
2025-07-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.devenam .com domain |
rev 1 |
2025-07-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.devenam .com domain |
rev 1 |
2025-07-21 |
| snort |
ET INFO Suspicious Fake Windows User-Agent in HTTP Header |
rev 2 |
2025-07-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.devenam .com domain |
rev 1 |
2025-07-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.devenam .com domain |
rev 1 |
2025-07-21 |
| suricata |
ET HUNTING Suspicious Fake Windows User-Agent in HTTP Header |
rev 3 |
2025-07-21 |
| sigma |
SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS |
experimental |
2025-07-21 |
| sigma |
Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators |
experimental |
2025-07-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.michaelfoody .com domain |
rev 1 |
2025-07-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.badrodent .com domain |
rev 1 |
2025-07-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.badrodent .com domain |
rev 1 |
2025-07-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.michaelfoody .com domain |
rev 1 |
2025-07-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.badrodent .com domain |
rev 1 |
2025-07-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.michaelfoody .com domain |
rev 1 |
2025-07-19 |