| sigma |
Elevated System Shell Spawned From Uncommon Parent Location |
test |
2025-03-06 |
| sigma |
Conhost Spawned By Uncommon Parent Process |
test |
2025-03-06 |
| snort |
ET TROJAN OtterCookie Victim Command Execution Confirmation To CnC Server |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET TROJAN OtterCookie Host Profile Exfil |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET TROJAN OtterCookie Payload Request |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| snort |
ET TROJAN OtterCookie File Exfiltration M1 |
rev 1 |
2025-03-05 |
| snort |
ET INFO Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET MALWARE OtterCookie Host Profile Exfil |
rev 1 |
2025-03-05 |
| suricata |
ET MALWARE OtterCookie File Exfiltration M1 |
rev 1 |
2025-03-05 |
| suricata |
ET MALWARE OtterCookie Victim Command Execution Confirmation To CnC Server |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET MALWARE OtterCookie Payload Request |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| suricata |
ET REMOTE_ACCESS Observed Zoho Assist Related Domain in TLS SNI |
rev 1 |
2025-03-05 |
| sigma |
Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock |
experimental |
2025-03-05 |
| sigma |
Python Initiated Connection |
test |
2025-03-05 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.deltako .com domain |
rev 1 |
2025-03-04 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.deltako .com domain |
rev 1 |
2025-03-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.deltako .com domain |
rev 1 |
2025-03-04 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.deltako .com domain |
rev 1 |
2025-03-04 |
| elastic |
Potential Cross Site Scripting (XSS) |
deprecated |
2025-03-04 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.yukejang .com domain |
rev 1 |
2025-03-03 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.cargo-dv .com domain |
rev 1 |
2025-03-03 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.yukejang .com domain |
rev 1 |
2025-03-03 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.cargo-dv .com domain |
rev 1 |
2025-03-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.yukejang .com domain |
rev 1 |
2025-03-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.cargo-dv .com domain |
rev 1 |
2025-03-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.cargo-dv .com domain |
rev 1 |
2025-03-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.yukejang .com domain |
rev 1 |
2025-03-03 |
| sigma |
Service Reload or Start - Linux |
test |
2025-03-03 |
| sigma |
Potential PowerShell Obfuscation Via WCHAR/CHAR |
test |
2025-03-03 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.weinteract .com domain |
rev 1 |
2025-02-28 |
| snort |
ET TROJAN PolarEdge Webshell Activity |
rev 1 |
2025-02-28 |
| snort |
ET TROJAN PolarEdge CnC Checkin |
rev 1 |
2025-02-28 |