| suricata |
ET MALWARE TA829 CnC Check-in - GAGA1 Variant |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE TA829 Requesting Next Stage |
rev 1 |
2025-06-27 |
| suricata |
ET MALWARE TA829 CnC Check-in - CMPN1 Variant |
rev 1 |
2025-06-27 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| snort |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| suricata |
ET EXPLOIT SSH Client Key Exchange Init Cookie Null |
rev 3 |
2025-06-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.szamitogepesz .com domain |
rev 1 |
2025-06-26 |
| suricata |
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound |
rev 1 |
2025-06-26 |
| elastic |
Deprecated - Suspicious File Creation in /etc for Persistence |
deprecated |
2025-06-26 |
| sigma |
Potential Notepad++ CVE-2025-49144 Exploitation |
experimental |
2025-06-26 |
| snort |
ET INFO Observed Usage of Non-Alphanumeric Javascript Obfuscation M1 |
rev 4 |
2025-06-25 |
| suricata |
ET HUNTING Observed Usage of Non-Alphanumeric Javascript Obfuscation M1 |
rev 4 |
2025-06-25 |
| snort |
ET TROJAN KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| snort |
ET TROJAN KimJongRAT Data Exfiltration Attempt |
rev 1 |
2025-06-24 |
| suricata |
ET MALWARE KimJongRAT CnC Checkin |
rev 1 |
2025-06-24 |
| suricata |
ET MALWARE KimJongRAT Data Exfiltration Attempt |
rev 1 |
2025-06-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.poptour .com .ar domain |
rev 1 |
2025-06-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.6ip .it domain |
rev 1 |
2025-06-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| suricata |
ET MALWARE Diamotrix POST Request M3 |
rev 1 |
2025-06-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.nettelcorp .com domain |
rev 1 |
2025-06-20 |
| sigma |
Attempts of Kerberos Coercion Via DNS SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing |
experimental |
2025-06-20 |
| sigma |
Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network |
experimental |
2025-06-20 |
| sigma |
Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation |
experimental |
2025-06-20 |
| snort |
ET TROJAN Adaptix C2 Default User-Agent Observed |
rev 1 |
2025-06-18 |
| snort |
ET TROJAN Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |
| suricata |
ET MALWARE Adaptix C2 X-Beacon-Id HTTP Header Observed |
rev 1 |
2025-06-18 |