| snort |
ET TROJAN PolarEdge Webshell Activity |
rev 1 |
2025-02-28 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.weinteract .com domain |
rev 1 |
2025-02-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.weinteract .com domain |
rev 1 |
2025-02-28 |
| suricata |
ET MALWARE PolarEdge Webshell Activity |
rev 1 |
2025-02-28 |
| suricata |
ET INFO Default PolarSSL/mbedTLS Certificate Issuer Observed in Certificate M1 |
rev 1 |
2025-02-28 |
| suricata |
ET MALWARE PolarEdge CnC Checkin |
rev 1 |
2025-02-28 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.weinteract .com domain |
rev 1 |
2025-02-28 |
| sigma |
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation |
experimental |
2025-02-28 |
| sigma |
BITS Transfer Job With Uncommon Or Suspicious Remote TLD |
test |
2025-02-28 |
| sigma |
Non Interactive PowerShell Process Spawned |
test |
2025-02-28 |
| snort |
ET CURRENT_EVENTS Darcula Credential Phish Landing Page M1 2025-02-27 |
rev 1 |
2025-02-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.webconstructions .co .uk domain |
rev 1 |
2025-02-27 |
| snort |
ET CURRENT_EVENTS Darcula Credential Phish Landing Page M2 2025-02-27 |
rev 1 |
2025-02-27 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.webconstructions .co .uk domain |
rev 1 |
2025-02-27 |
| snort |
ET CURRENT_EVENTS Darcula Credential Phish Socket Response 2025-02-27 |
rev 1 |
2025-02-27 |
| suricata |
ET PHISHING Darcula Credential Phish Socket Response 2025-02-27 |
rev 1 |
2025-02-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.webconstructions .co .uk domain |
rev 1 |
2025-02-27 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.webconstructions .co .uk domain |
rev 1 |
2025-02-27 |
| suricata |
ET PHISHING Darcula Credential Phish Landing Page M1 2025-02-27 |
rev 1 |
2025-02-27 |
| suricata |
ET PHISHING Darcula Credential Phish Landing Page M2 2025-02-27 |
rev 1 |
2025-02-27 |
| snort |
ET TROJAN Divulge Stealer Data Exfiltration Attempt |
rev 1 |
2025-02-26 |
| snort |
ET TROJAN Divulge Stealer CnC Checkin |
rev 1 |
2025-02-26 |
| suricata |
ET MALWARE Divulge Stealer Data Exfiltration Attempt |
rev 1 |
2025-02-26 |
| suricata |
ET MALWARE Divulge Stealer CnC Checkin |
rev 1 |
2025-02-26 |
| sigma |
PUA - AdFind.EXE Execution |
experimental |
2025-02-26 |
| sigma |
HTTP Request to Low Reputation TLD or Suspicious File Extension |
experimental |
2025-02-26 |
| sigma |
Renamed AdFind Execution |
test |
2025-02-26 |
| sigma |
Potential DLL Sideloading Of MsCorSvc.DLL |
test |
2025-02-26 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.pitlobra .ro domain |
rev 1 |
2025-02-25 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.power-media .ro domain |
rev 1 |
2025-02-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.pitlobra .ro domain |
rev 1 |
2025-02-25 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.power-media .ro domain |
rev 1 |
2025-02-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.pitlobra .ro domain |
rev 1 |
2025-02-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.power-media .ro domain |
rev 1 |
2025-02-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.power-media .ro domain |
rev 1 |
2025-02-25 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.pitlobra .ro domain |
rev 1 |
2025-02-25 |
| sigma |
Nslookup PowerShell Download Cradle |
test |
2025-02-25 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.compositgroup .com domain |
rev 1 |
2025-02-24 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.compositgroup .com domain |
rev 1 |
2025-02-24 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.compositgroup .com domain |
rev 1 |
2025-02-24 |