| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.garymcgill .ca domain |
rev 1 |
2025-02-12 |
| sigma |
Kalambur Backdoor Curl TOR SOCKS Proxy Execution |
experimental |
2025-02-11 |
| snort |
ET CURRENT_EVENTS Generic Credential Phish Landing Page 2025-02-10 |
rev 1 |
2025-02-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.serprise .com domain |
rev 1 |
2025-02-10 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.serprise .com domain |
rev 1 |
2025-02-10 |
| suricata |
ET PHISHING Generic Credential Phish Landing Page 2025-02-10 |
rev 1 |
2025-02-10 |
| suricata |
ET INFO Plaintext SSH Private Key Outbound over HTTP |
rev 2 |
2025-02-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.serprise .com domain |
rev 1 |
2025-02-10 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.serprise .com domain |
rev 1 |
2025-02-10 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ultrapanel .us domain |
rev 1 |
2025-02-08 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ultrapanel .us domain |
rev 1 |
2025-02-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ultrapanel .us domain |
rev 1 |
2025-02-08 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ultrapanel .us domain |
rev 1 |
2025-02-08 |
| snort |
ET INFO Redirect to Lovable AI Generated WebApp |
rev 1 |
2025-02-07 |
| snort |
ET INFO Lovable AI Generated Landing Page 2025-02-07 |
rev 1 |
2025-02-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.mounthoodlodges .com domain |
rev 1 |
2025-02-07 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.mounthoodlodges .com domain |
rev 1 |
2025-02-07 |
| suricata |
ET INFO Lovable AI Generated Landing Page 2025-02-07 |
rev 1 |
2025-02-07 |
| suricata |
ET MALWARE Winos4.0 Framework Fake BMP Download Containing XOR encoded .dll |
rev 1 |
2025-02-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.mounthoodlodges .com domain |
rev 1 |
2025-02-07 |
| suricata |
ET INFO Redirect to Lovable AI Generated WebApp |
rev 1 |
2025-02-07 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.mounthoodlodges .com domain |
rev 1 |
2025-02-07 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.heronquays .com domain |
rev 1 |
2025-02-06 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.heronquays .com domain |
rev 1 |
2025-02-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.heronquays .com domain |
rev 1 |
2025-02-06 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.heronquays .com domain |
rev 1 |
2025-02-06 |
| sigma |
AADInternals PowerShell Cmdlets Execution - ProccessCreation |
test |
2025-02-06 |
| sigma |
AADInternals PowerShell Cmdlets Execution - PsScript |
test |
2025-02-06 |
| snort |
ET POLICY Plaintext SSH Private Key Outbound over HTTP |
rev 1 |
2025-02-05 |
| sigma |
MMC Executing Files with Reversed Extensions Using RTLO Abuse |
experimental |
2025-02-05 |
| sigma |
Scheduled Task Creation with Curl and PowerShell Execution Combo |
experimental |
2025-02-05 |
| sigma |
Scheduled Task Creation Masquerading as System Processes |
experimental |
2025-02-05 |
| sigma |
PUA - NimScan Execution |
test |
2025-02-05 |
| sigma |
MMC Loading Script Engines DLLs |
experimental |
2025-02-05 |
| sigma |
Potentially Suspicious Child Processes Spawned by ConHost |
experimental |
2025-02-05 |
| snort |
ET SHELLCODE Possible 0x0a0a0a0a Heap Spray Attempt |
rev 2 |
2025-02-04 |
| snort |
ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0a0a0a0a |
rev 2 |
2025-02-04 |
| snort |
ET SHELLCODE Common 0a0a0a0a Heap Spray String |
rev 3 |
2025-02-04 |
| snort |
ET INFO Possible Hex Obfuscated JavaScript Heap Spray 0a0a0a0a |
rev 3 |
2025-02-04 |