| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.stofcheck-ballinger .com domain |
rev 1 |
2025-07-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.stofcheck-ballinger .com domain |
rev 1 |
2025-07-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.stofcheck-ballinger .com domain |
rev 1 |
2025-07-04 |
| sigma |
Potential AS-REP Roasting via Kerberos TGT Requests |
experimental |
2025-07-04 |
| sigma |
Potential Active Directory Reconnaissance/Enumeration Via LDAP |
test |
2025-07-04 |
| sigma |
Potential Binary Or Script Dropper Via PowerShell |
test |
2025-07-04 |
| sigma |
Remote Thread Creation In Uncommon Target Image |
test |
2025-07-04 |
| sigma |
ADS Zone.Identifier Deleted By Uncommon Application |
test |
2025-07-04 |
| sigma |
Suspicious Sysmon as Execution Parent |
test |
2025-07-04 |
| sigma |
Remote Thread Created In Shell Application |
test |
2025-07-04 |
| snort |
ET WEB_SPECIFIC_APPS HikVision triggerSnapshot fileUrl Parameter Arbitrary File Download Attempt |
rev 1 |
2025-07-03 |
| snort |
ET INFO ConnectWise ScreenConnect Revoked Code Signing Certificate M2 |
rev 1 |
2025-07-03 |
| snort |
ET INFO ConnectWise ScreenConnect Revoked Code Signing Certificate M1 |
rev 1 |
2025-07-03 |
| snort |
ET WEB_SPECIFIC_APPS HikVision upload.action JSP Webshell Upload Attempt |
rev 1 |
2025-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS HikVision triggerSnapshot fileUrl Parameter Arbitrary File Download Attempt |
rev 1 |
2025-07-03 |
| suricata |
ET HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M2 |
rev 1 |
2025-07-03 |
| suricata |
ET HUNTING ConnectWise ScreenConnect Revoked Code Signing Certificate M1 |
rev 1 |
2025-07-03 |
| suricata |
ET WEB_SPECIFIC_APPS HikVision upload.action JSP Webshell Upload Attempt |
rev 1 |
2025-07-03 |
| snort |
ET WEB_SPECIFIC_APPS D-Link importhtml sql Parameter SQL Injection Attempt |
rev 1 |
2025-07-02 |
| suricata |
ET WEB_SPECIFIC_APPS D-Link importhtml sql Parameter SQL Injection Attempt |
rev 1 |
2025-07-02 |
| sigma |
Suspicious SignIns From A Non Registered Device |
test |
2025-07-02 |
| snort |
ET TROJAN Myth Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-07-01 |
| snort |
ET TROJAN Myth Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-07-01 |
| suricata |
ET MALWARE Myth Stealer Data Exfiltration Attempt M2 |
rev 1 |
2025-07-01 |
| suricata |
ET MALWARE Myth Stealer Data Exfiltration Attempt M1 |
rev 1 |
2025-07-01 |
| sigma |
HackTool - Doppelanger LSASS Dumper Execution |
experimental |
2025-07-01 |
| sigma |
HackTool - HollowReaper Execution |
experimental |
2025-07-01 |
| snort |
ET P2P BitTorrent peer sync |
rev 14 |
2025-06-30 |
| snort |
ET TROJAN BitterAPT Kiwi2.0 Data Exfiltration Attempt |
rev 1 |
2025-06-30 |
| suricata |
ET P2P BitTorrent peer sync |
rev 14 |
2025-06-30 |
| suricata |
ET MALWARE BitterAPT Kiwi2.0 Data Exfiltration Attempt |
rev 1 |
2025-06-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.nigelupchurch .com domain |
rev 1 |
2025-06-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.nigelupchurch .com domain |
rev 1 |
2025-06-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.nigelupchurch .com domain |
rev 1 |
2025-06-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.nigelupchurch .com domain |
rev 1 |
2025-06-28 |
| suricata |
ET MALWARE zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN zgRAT / PureLogs CnC Server Connection M3 |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 Requesting Next Stage |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 CnC Check-in - CMPN1 Variant |
rev 1 |
2025-06-27 |
| snort |
ET TROJAN TA829 CnC Check-in - GAGA1 Variant |
rev 1 |
2025-06-27 |