| sigma |
Potential SAP NetViewer Webshell Command Execution |
experimental |
2025-05-14 |
| sigma |
Potential Java WebShell Upload in SAP NetViewer Server |
experimental |
2025-05-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.innovativegovernance .com domain |
rev 1 |
2025-05-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.innovativegovernance .com domain |
rev 1 |
2025-05-13 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.wulabs .org domain |
rev 1 |
2025-05-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.wulabs .org domain |
rev 1 |
2025-05-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.wulabs .org domain |
rev 1 |
2025-05-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.wulabs .org domain |
rev 1 |
2025-05-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.innovativegovernance .com domain |
rev 1 |
2025-05-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.innovativegovernance .com domain |
rev 1 |
2025-05-13 |
| snort |
ET INFO ObfusHTML Usage |
rev 1 |
2025-05-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.skamaria .net domain |
rev 1 |
2025-05-12 |
| snort |
ET TROJAN RedExt C2 Agent Register |
rev 1 |
2025-05-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.skamaria .net domain |
rev 1 |
2025-05-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.richsfamilyonline .net domain |
rev 1 |
2025-05-12 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.richsfamilyonline .net domain |
rev 1 |
2025-05-12 |
| snort |
ET TROJAN RedExt C2 Agent Exfiltration |
rev 1 |
2025-05-12 |
| snort |
ET TROJAN RedExt C2 Agent Beacon |
rev 1 |
2025-05-12 |
| snort |
ET CURRENT_EVENTS DollyWay v3 PHP TDS Redirect M2 |
rev 1 |
2025-05-12 |
| suricata |
ET EXPLOIT_KIT DollyWay v3 PHP TDS Redirect M2 |
rev 1 |
2025-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.richsfamilyonline .net domain |
rev 1 |
2025-05-12 |
| suricata |
ET MALWARE RedExt C2 Agent Beacon |
rev 1 |
2025-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.richsfamilyonline .net domain |
rev 1 |
2025-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.skamaria .net domain |
rev 1 |
2025-05-12 |
| suricata |
ET INFO ObfusHTML Usage |
rev 1 |
2025-05-12 |
| suricata |
ET MALWARE RedExt C2 Agent Exfiltration |
rev 1 |
2025-05-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.skamaria .net domain |
rev 1 |
2025-05-12 |
| suricata |
ET MALWARE RedExt C2 Agent Register |
rev 1 |
2025-05-12 |
| sigma |
MSHTA Execution with Suspicious File Extensions |
test |
2025-05-12 |
| sigma |
Crash Dump Created By Operating System |
experimental |
2025-05-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.brianpuppy .com domain |
rev 1 |
2025-05-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.brianpuppy .com domain |
rev 1 |
2025-05-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.brianpuppy .com domain |
rev 1 |
2025-05-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.brianpuppy .com domain |
rev 1 |
2025-05-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.faizinternational .com .np domain |
rev 1 |
2025-05-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.faizinternational .com .np domain |
rev 1 |
2025-05-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.faizinternational .com .np domain |
rev 1 |
2025-05-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.faizinternational .com .np domain |
rev 1 |
2025-05-10 |
| snort |
ET CURRENT_EVENTS DollyWay v3 PHP TDS Redirect |
rev 1 |
2025-05-09 |
| suricata |
ET EXPLOIT_KIT DollyWay v3 PHP TDS Redirect |
rev 1 |
2025-05-09 |