| snort |
ET TROJAN TINYSHELL impad Variant Encrypted Auth Token |
rev 1 |
2025-03-14 |
| snort |
ET TROJAN TINYSHELL impad Variant Command Packet |
rev 1 |
2025-03-14 |
| suricata |
ET MALWARE TINYSHELL impad Variant Command Packet |
rev 1 |
2025-03-14 |
| suricata |
ET MALWARE TINYSHELL impad Variant Encrypted Auth Token |
rev 1 |
2025-03-14 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container |
deprecated |
2025-03-14 |
| elastic |
Deprecated - SSH Connection Established Inside A Running Container |
deprecated |
2025-03-14 |
| snort |
ET TROJAN Observed Rasuq Force Domain in TLS SNI |
rev 1 |
2025-03-12 |
| snort |
ET TROJAN Observed DNS Query to Rasuq Force Domain |
rev 1 |
2025-03-12 |
| suricata |
ET MALWARE Observed Rasuq Force Domain in TLS SNI |
rev 1 |
2025-03-12 |
| suricata |
ET MALWARE Observed DNS Query to Rasuq Force Domain |
rev 1 |
2025-03-12 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.iamnotwhoiam .net domain |
rev 1 |
2025-03-11 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.iamnotwhoiam .net domain |
rev 1 |
2025-03-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.iamnotwhoiam .net domain |
rev 1 |
2025-03-11 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.iamnotwhoiam .net domain |
rev 1 |
2025-03-11 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mundra .com domain |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mundra .com domain |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| snort |
ET CURRENT_EVENTS TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in TLS SNI |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in TLS SNI |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in TLS SNI |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in TLS SNI |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in DNS Lookup |
rev 1 |
2025-03-10 |
| suricata |
ET PHISHING TA453 Domain in TLS SNI |
rev 1 |
2025-03-10 |