| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.compositgroup .com domain |
rev 1 |
2025-02-24 |
| sigma |
Suspicious Binary Writes Via AnyDesk |
test |
2025-02-24 |
| sigma |
AspNetCompiler Execution |
test |
2025-02-24 |
| sigma |
Remote Access Tool - Anydesk Execution From Suspicious Folder |
test |
2025-02-24 |
| sigma |
Remote Access Tool - AnyDesk Execution |
test |
2025-02-24 |
| sigma |
AddinUtil.EXE Execution From Uncommon Directory |
test |
2025-02-24 |
| sigma |
Remote Access Tool - AnyDesk Incoming Connection |
experimental |
2025-02-24 |
| sigma |
Potentially Suspicious ASP.NET Compilation Via AspNetCompiler |
test |
2025-02-24 |
| sigma |
Creation of an Executable by an Executable |
test |
2025-02-24 |
| sigma |
Anydesk Remote Access Software Service Installation |
test |
2025-02-24 |
| sigma |
Potential Obfuscated Ordinal Call Via Rundll32 |
test |
2025-02-23 |
| sigma |
Process Memory Dump Via Comsvcs.DLL |
test |
2025-02-23 |
| sigma |
Suspicious Non-Browser Network Communication With Google API |
experimental |
2025-02-22 |
| snort |
ET TROJAN HTran/SensLiceld.A response to infected host - Outbound Connection Attempt |
rev 1 |
2025-02-21 |
| snort |
ET INFO Go-http-client User-Agent Observed Inbound |
rev 1 |
2025-02-21 |
| snort |
ET INFO Go-http-client User-Agent Observed Outbound |
rev 1 |
2025-02-21 |
| snort |
ET TROJAN HTran/SensLiceld.A response to infected host - Inbound Connection Attempt |
rev 7 |
2025-02-21 |
| suricata |
ET INFO Go-http-client User-Agent Observed Inbound |
rev 1 |
2025-02-21 |
| suricata |
ET INFO Go-http-client User-Agent Observed Outbound |
rev 1 |
2025-02-21 |
| suricata |
ET INFO Observed trycloudflare .com Domain in TLS SNI |
rev 1 |
2025-02-21 |
| suricata |
ET MALWARE HTran/SensLiceld.A response to infected host - Outbound Connection Attempt |
rev 1 |
2025-02-21 |
| suricata |
ET MALWARE HTran/SensLiceld.A response to infected host - Inbound Connection Attempt |
rev 9 |
2025-02-21 |
| sigma |
Notepad Password Files Discovery |
experimental |
2025-02-21 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.anteus .com domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.devreler .com domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.pelshare .com .au domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.anteus .com domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.devreler .com domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.pelshare .com .au domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.anteus .com domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.devreler .com domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.pelshare .com .au domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.devreler .com domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.anteus .com domain |
rev 1 |
2025-02-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.pelshare .com .au domain |
rev 1 |
2025-02-20 |
| snort |
ET INFO External IP Lookup via GeoLocation-db |
rev 1 |
2025-02-19 |
| snort |
ET EXPLOIT Attempted Unauthenticated Palo Alto Global Protect Administrator Password Change M1 |
rev 1 |
2025-02-19 |
| snort |
ET CURRENT_EVENTS NOTG Phish Kit Visitor Fingerprinting |
rev 1 |
2025-02-19 |
| snort |
ET CURRENT_EVENTS NOTG Phish Landing Page 2025-02-19 |
rev 1 |
2025-02-19 |
| snort |
ET INFO External IP Lookup via FreeIpAPI |
rev 1 |
2025-02-19 |