| suricata |
ET MALWARE MacOS/Adload Proxy Node Response |
rev 3 |
2025-03-21 |
| suricata |
ET MALWARE SvcStealer CNC Tasking Checkin |
rev 1 |
2025-03-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.or-g .net domain |
rev 1 |
2025-03-20 |
| snort |
ET TROJAN Amadey CnC Response |
rev 1 |
2025-03-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.silvaharo .com domain |
rev 1 |
2025-03-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.silvaharo .com domain |
rev 1 |
2025-03-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.or-g .net domain |
rev 1 |
2025-03-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.schrottspiele .de domain |
rev 1 |
2025-03-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.schrottspiele .de domain |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.schrottspiele .de domain |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.or-g .net domain |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.or-g .net domain |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.silvaharo .com domain |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.schrottspiele .de domain |
rev 1 |
2025-03-20 |
| suricata |
ET MALWARE Amadey CnC Response |
rev 1 |
2025-03-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.silvaharo .com domain |
rev 1 |
2025-03-20 |
| snort |
ET WEB_SPECIFIC_APPS Ncast DVR Hardcoded Credentials Login Attempt |
rev 1 |
2025-03-19 |
| suricata |
ET WEB_SPECIFIC_APPS Ncast DVR Hardcoded Credentials Login Attempt |
rev 1 |
2025-03-19 |
| sigma |
Suspicious LNK Command-Line Padding with Whitespace Characters |
experimental |
2025-03-19 |
| sigma |
Potential Browser Data Stealing |
test |
2025-03-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.switchestudio .com domain |
rev 1 |
2025-03-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.switchestudio .com domain |
rev 1 |
2025-03-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.switchestudio .com domain |
rev 1 |
2025-03-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.switchestudio .com domain |
rev 1 |
2025-03-18 |
| sigma |
Disable Or Stop Services |
test |
2025-03-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.pastrypowered .com domain |
rev 1 |
2025-03-17 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.jtizyl .net domain |
rev 1 |
2025-03-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.jtizyl .net domain |
rev 1 |
2025-03-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.pastrypowered .com domain |
rev 1 |
2025-03-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.pastrypowered .com domain |
rev 1 |
2025-03-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.pastrypowered .com domain |
rev 1 |
2025-03-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.jtizyl .net domain |
rev 1 |
2025-03-17 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.jtizyl .net domain |
rev 1 |
2025-03-17 |
| sigma |
Potential Product Class Reconnaissance Via Wmic.EXE |
test |
2025-03-17 |
| sigma |
Buffer Overflow Attempts |
test |
2025-03-17 |
| sigma |
AWS New Lambda Layer Attached |
test |
2025-03-17 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.bsfa .info domain |
rev 1 |
2025-03-16 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.bsfa .info domain |
rev 1 |
2025-03-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.bsfa .info domain |
rev 1 |
2025-03-16 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.bsfa .info domain |
rev 1 |
2025-03-16 |