| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.incorpnow .cn domain |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| suricata |
ET MALWARE Gremlin Stealer CnC Successful Exfil Confirmation |
rev 1 |
2025-04-29 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.spoggi .com domain |
rev 1 |
2025-04-29 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.rheinfathia .com domain |
rev 1 |
2025-04-28 |
| sigma |
Potential SAP NetWeaver Webshell Creation |
experimental |
2025-04-28 |
| sigma |
Suspicious Child Process of SAP NetWeaver - Linux |
experimental |
2025-04-28 |
| sigma |
Suspicious Child Process of SAP NetWeaver |
experimental |
2025-04-28 |
| sigma |
Potential SAP NetWeaver Webshell Creation - Linux |
experimental |
2025-04-28 |
| sigma |
Cisco Modify Configuration |
test |
2025-04-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.moldeo .org domain |
rev 1 |
2025-04-27 |
| snort |
ET INFO Gamaredon APT Style Delimiter Observed In HTTP Header |
rev 1 |
2025-04-25 |
| snort |
ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP URI |
rev 1 |
2025-04-25 |
| snort |
ET TROJAN Gamaredon APT Style Delimiter Observed In HTTP User-Agent |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP User-Agent |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP URI |
rev 1 |
2025-04-25 |
| suricata |
ET MALWARE Gamaredon APT Style Delimiter Observed In HTTP Cookie |
rev 1 |
2025-04-25 |
| suricata |
ET HUNTING Gamaredon APT Style Delimiter Observed In HTTP Header |
rev 1 |
2025-04-25 |
| snort |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| snort |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE ClickFix Related Payload Inbound |
rev 1 |
2025-04-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.monkeywills .com domain |
rev 1 |
2025-04-24 |
| suricata |
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain |
rev 1 |
2025-04-24 |
| snort |
ET EXPLOIT SSH Client Key Exchange Init Cookie Null |
rev 2 |
2025-04-23 |
| snort |
ET TROJAN Interlock RAT CnC Checkin |
rev 1 |
2025-04-22 |
| snort |
ET TROJAN StealC v2 Fake 404 Page Observed |
rev 1 |
2025-04-22 |
| suricata |
ET MALWARE Interlock RAT CnC Checkin |
rev 1 |
2025-04-22 |
| suricata |
ET MALWARE StealC v2 Fake 404 Page Observed |
rev 1 |
2025-04-22 |
| snort |
ET INFO HTTP H2C Smuggling - HTTP2-Settings Omitted in Connection Header |
rev 1 |
2025-04-21 |