| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| snort |
ET TROJAN Agent Tesla CnC Exfil via TCP |
rev 1 |
2025-07-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.casiomexico .com .mx domain |
rev 1 |
2025-07-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.coybu .com domain |
rev 1 |
2025-07-10 |
| suricata |
ET MALWARE Agent Tesla CnC Exfil via TCP |
rev 1 |
2025-07-10 |
| suricata |
ET EXPLOIT GTPDoor Trigger Packet Request |
rev 1 |
2025-07-09 |
| suricata |
ET EXPLOIT GTPDoor Trigger Packet Response |
rev 1 |
2025-07-09 |
| suricata |
ET INFO Invalid GTP Response Packet Observed |
rev 1 |
2025-07-09 |
| elastic |
Deprecated - Azure Virtual Network Device Modified or Deleted |
deprecated |
2025-07-09 |
| sigma |
ADExplorer Writing Complete AD Snapshot Into .dat File |
experimental |
2025-07-09 |
| sigma |
Disabling Windows Defender WMI Autologger Session via Reg.exe |
experimental |
2025-07-09 |
| sigma |
Active Directory Database Snapshot Via ADExplorer |
test |
2025-07-09 |
| sigma |
Windows Defender Context Menu Removed |
experimental |
2025-07-09 |
| sigma |
Suspicious Active Directory Database Snapshot Via ADExplorer |
test |
2025-07-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| snort |
ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt |
rev 2 |
2025-07-08 |
| snort |
ET TROJAN NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| snort |
ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE |
rev 4 |
2025-07-08 |
| snort |
ET TROJAN NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan Data Exfiltration Attempt |
rev 1 |
2025-07-08 |
| suricata |
ET MALWARE NordDragonScan CnC Checkin |
rev 1 |
2025-07-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| suricata |
ET EXPLOIT Equation Group EGREGIOUSBLUNDER Fortigate Exploit Attempt |
rev 7 |
2025-07-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bestprogramsforkids .com domain |
rev 1 |
2025-07-08 |
| suricata |
ET EXPLOIT Eir D1000 Modem CWMP Exploit RCE |
rev 9 |
2025-07-08 |
| sigma |
Remote Thread Creation By Uncommon Source Image |
test |
2025-07-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.tvphone .com domain |
rev 1 |
2025-07-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mascables .com domain |
rev 1 |
2025-07-05 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mascables .com domain |
rev 1 |
2025-07-05 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mascables .com domain |
rev 1 |
2025-07-05 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mascables .com domain |
rev 1 |
2025-07-05 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.stofcheck-ballinger .com domain |
rev 1 |
2025-07-04 |