| suricata |
ET HUNTING HTTP Response Containing Base64-Encoded and Compressed Powershell Payload Keywords |
rev 1 |
2025-06-11 |
| snort |
ET TROJAN Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com |
rev 4 |
2025-06-09 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.alyaf .com domain |
rev 1 |
2025-06-09 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.alyaf .com domain |
rev 1 |
2025-06-09 |
| snort |
ET TROJAN SVCStealer CnC Checkin Confirmation |
rev 1 |
2025-06-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.alyaf .com domain |
rev 1 |
2025-06-09 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.alyaf .com domain |
rev 1 |
2025-06-09 |
| suricata |
ET MALWARE Common Stealer Behavior - Source IP Associated with Hosting Provider Check via ip.api .com |
rev 4 |
2025-06-09 |
| suricata |
ET MALWARE SVCStealer CnC Checkin Confirmation |
rev 1 |
2025-06-09 |
| snort |
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound |
rev 1 |
2025-06-06 |
| snort |
ET TROJAN Observed GET Request to ClickFix Style URI |
rev 1 |
2025-06-06 |
| snort |
ET TROJAN Observed GET Request to ClickFix Style URI |
rev 1 |
2025-06-06 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.telugumaster .com domain |
rev 1 |
2025-06-06 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.telugumaster .com domain |
rev 1 |
2025-06-06 |
| suricata |
ET MALWARE Observed GET Request to ClickFix Style URI |
rev 1 |
2025-06-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.telugumaster .com domain |
rev 1 |
2025-06-06 |
| suricata |
ET MALWARE Observed GET Request to ClickFix Style URI |
rev 1 |
2025-06-06 |
| suricata |
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound |
rev 1 |
2025-06-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.telugumaster .com domain |
rev 1 |
2025-06-06 |
| sigma |
HKTL - SharpSuccessor Privilege Escalation Tool Execution |
experimental |
2025-06-06 |
| snort |
ET TROJAN Diamotrix Clipper POST Request M1 |
rev 1 |
2025-06-05 |
| snort |
ET TROJAN ShadowByte Botnet FrameWork Zombie C2 Command Request |
rev 1 |
2025-06-05 |
| snort |
ET TROJAN ShadowByte Botnet Framework New Zombie Checkin |
rev 1 |
2025-06-05 |
| suricata |
ET MALWARE ShadowByte Botnet FrameWork Zombie C2 Command Request |
rev 1 |
2025-06-05 |
| suricata |
ET MALWARE ShadowByte Botnet Framework New Zombie Checkin |
rev 1 |
2025-06-05 |
| suricata |
ET MALWARE Diamotrix Clipper POST Request M1 |
rev 1 |
2025-06-05 |
| sigma |
PowerShell MSI Install via WindowsInstaller COM From Remote Location |
experimental |
2025-06-05 |
| snort |
ET USER_AGENTS Fake OneDrive User-Agent Observed |
rev 1 |
2025-06-04 |
| snort |
ET TROJAN Possible Windows executable sent when remote host claims to send a Text File |
rev 16 |
2025-06-04 |
| suricata |
ET USER_AGENTS Fake OneDrive User-Agent Observed |
rev 1 |
2025-06-04 |
| suricata |
ET MALWARE Possible Windows executable sent when remote host claims to send a Text File |
rev 26 |
2025-06-04 |
| sigma |
System Owner or User Discovery - Linux |
test |
2025-06-04 |
| sigma |
Local Groups Discovery - Linux |
test |
2025-06-04 |
| sigma |
BITS Client BitsProxy DLL Loaded By Uncommon Process |
experimental |
2025-06-04 |
| sigma |
Suspicious Windows Defender Registry Key Tampering Via Reg.EXE |
test |
2025-06-04 |
| sigma |
Disable Internal Tools or Feature in Registry |
test |
2025-06-04 |
| sigma |
RegAsm.EXE Execution Without CommandLine Flags or Files |
experimental |
2025-06-04 |
| sigma |
File Decoded From Base64/Hex Via Certutil.EXE |
test |
2025-06-04 |
| sigma |
MSSQL Destructive Query |
experimental |
2025-06-04 |
| sigma |
Access of Sudoers File Content |
test |
2025-06-04 |