| suricata |
ET INFO Observed ipconfig Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET INFO Observed netstat Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET INFO Observed tasklist Command via Inbound ICMP |
rev 1 |
2025-05-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.readymindit .com domain |
rev 1 |
2025-05-30 |
| suricata |
ET INFO Observed tasklist Output From Internal Host Over UDP |
rev 1 |
2025-05-30 |
| sigma |
Suspicious Double Extension File Execution |
stable |
2025-05-30 |
| sigma |
Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image |
test |
2025-05-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bowmansarrow .us domain |
rev 1 |
2025-05-29 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bowmansarrow .us domain |
rev 1 |
2025-05-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bowmansarrow .us domain |
rev 1 |
2025-05-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bowmansarrow .us domain |
rev 1 |
2025-05-29 |
| sigma |
Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server |
experimental |
2025-05-29 |
| snort |
ET WEB_SPECIFIC_APPS Rockwell Powermonitor 1000 firstrun Authentication Bypass Attempt |
rev 1 |
2025-05-28 |
| snort |
ET WEB_SPECIFIC_APPS ASUS asusrouter-- User-Agent And asus_token Cookie Null Byte Authentication Bypass Attempt |
rev 1 |
2025-05-28 |
| suricata |
ET WEB_SPECIFIC_APPS ASUS asusrouter-- User-Agent And asus_token Cookie Null Byte Authentication Bypass Attempt |
rev 1 |
2025-05-28 |
| suricata |
ET WEB_SPECIFIC_APPS Rockwell Powermonitor 1000 firstrun Authentication Bypass Attempt |
rev 1 |
2025-05-28 |
| sigma |
MSSQL Server Failed Logon From External Network |
test |
2025-05-28 |
| snort |
ET TROJAN HATVIBE C2 Response |
rev 1 |
2025-05-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.kameli .org domain |
rev 1 |
2025-05-27 |
| snort |
ET TROJAN HATVIBE C2 Beacon |
rev 1 |
2025-05-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.kameli .org domain |
rev 1 |
2025-05-27 |
| snort |
ET INFO DYNAMIC_DNS Query to sslip .io Domain |
rev 1 |
2025-05-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.kameli .org domain |
rev 1 |
2025-05-27 |
| suricata |
ET INFO DYNAMIC_DNS Query to sslip .io Domain |
rev 1 |
2025-05-27 |
| suricata |
ET MALWARE HATVIBE C2 Response |
rev 1 |
2025-05-27 |
| suricata |
ET MALWARE HATVIBE C2 Beacon |
rev 1 |
2025-05-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.kameli .org domain |
rev 1 |
2025-05-27 |
| sigma |
Obfuscated PowerShell MSI Install via WindowsInstaller COM |
experimental |
2025-05-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dingshun .org domain |
rev 1 |
2025-05-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dingshun .org domain |
rev 1 |
2025-05-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dingshun .org domain |
rev 1 |
2025-05-26 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dingshun .org domain |
rev 1 |
2025-05-26 |
| sigma |
Proxy Execution via Vshadow |
experimental |
2025-05-26 |
| sigma |
DMSA Link Attributes Modified |
experimental |
2025-05-24 |
| sigma |
New DMSA Service Account Created in Specific OUs |
experimental |
2025-05-24 |
| sigma |
DMSA Service Account Created in Specific OUs - PowerShell |
experimental |
2025-05-24 |
| sigma |
Potential Abuse of Linux Magic System Request Key |
experimental |
2025-05-23 |
| snort |
ET EXPLOIT Windows Microsoft .XRM-MS File / NTLM Information Disclosure |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN CHERRYSPY.Backdoor Russia APT28 Key Exchange Response |
rev 1 |
2025-05-22 |
| snort |
ET TROJAN APT28 Russia Macro Loader HTTP POST |
rev 1 |
2025-05-22 |