| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.michaelfoody .com domain |
rev 1 |
2025-07-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.badrodent .com domain |
rev 1 |
2025-07-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.betak .net domain |
rev 1 |
2025-07-18 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.betak .net domain |
rev 1 |
2025-07-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.betak .net domain |
rev 1 |
2025-07-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.betak .net domain |
rev 1 |
2025-07-18 |
| sigma |
PowerShell Script With File Upload Capabilities |
test |
2025-07-18 |
| sigma |
PowerShell Download and Execution Cradles |
test |
2025-07-18 |
| sigma |
Suspicious Invoke-WebRequest Execution |
test |
2025-07-18 |
| sigma |
Potential DLL File Download Via PowerShell Invoke-WebRequest |
test |
2025-07-18 |
| sigma |
Suspicious PowerShell In Registry Run Keys |
test |
2025-07-18 |
| sigma |
Change User Agents with WebRequest |
test |
2025-07-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.stardustcommercialservices .com domain |
rev 1 |
2025-07-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.stardustcommercialservices .com domain |
rev 1 |
2025-07-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.stardustcommercialservices .com domain |
rev 1 |
2025-07-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.stardustcommercialservices .com domain |
rev 1 |
2025-07-17 |
| snort |
ET TROJAN SillyRAT CnC Server PING Inbound |
rev 1 |
2025-07-16 |
| snort |
ET TROJAN SillyRAT CnC Victim Keylogger Exfil |
rev 1 |
2025-07-16 |
| suricata |
ET MALWARE SillyRAT CnC Victim Keylogger Exfil |
rev 1 |
2025-07-16 |
| suricata |
ET MALWARE SillyRAT CnC Server PING Inbound |
rev 1 |
2025-07-16 |
| elastic |
Deprecated - Azure Entra Sign-in Brute Force Microsoft 365 Accounts by Repeat Source |
deprecated |
2025-07-16 |
| elastic |
Deprecated - AWS EC2 Snapshot Activity |
deprecated |
2025-07-16 |
| sigma |
WinRAR Execution in Non-Standard Folder |
test |
2025-07-16 |
| sigma |
WinRAR Creating Files in Startup Locations |
experimental |
2025-07-16 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.envytations .com domain |
rev 1 |
2025-07-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.envytations .com domain |
rev 1 |
2025-07-15 |
| snort |
ET TROJAN Raton TLS Server Certificate |
rev 1 |
2025-07-15 |
| suricata |
ET MALWARE Raton TLS Server Certificate |
rev 1 |
2025-07-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.envytations .com domain |
rev 1 |
2025-07-15 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.envytations .com domain |
rev 1 |
2025-07-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.myowndamnnode .com domain |
rev 1 |
2025-07-14 |
| snort |
ET RETIRED BunnyLoader Initial CnC Checkin Response |
rev 2 |
2025-07-14 |
| snort |
ET RETIRED MacOS/MacStealer Data Exfiltration Attempt |
rev 2 |
2025-07-14 |
| snort |
ET RETIRED Win32/SSLoad Payload Response |
rev 2 |
2025-07-14 |
| snort |
ET RETIRED JynxLoaderV2 CnC Checkin |
rev 2 |
2025-07-14 |
| snort |
ET TROJAN Numinon CnC Activity via WebSockets |
rev 1 |
2025-07-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.martyluther .com domain |
rev 1 |
2025-07-14 |
| snort |
ET TROJAN Observed DNS Query to UNK_DropPitch Domain |
rev 1 |
2025-07-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.adventuregameclub .com domain |
rev 1 |
2025-07-14 |
| snort |
ET RETIRED TA421 Wineloader CnC Checkin |
rev 2 |
2025-07-14 |