| suricata |
ET SHELLCODE Double BackSlash Hex Obfuscated JavaScript Heap Spray 0a0a0a0a |
rev 5 |
2025-02-04 |
| suricata |
ET SHELLCODE Common 0a0a0a0a Heap Spray String |
rev 7 |
2025-02-04 |
| suricata |
ET SHELLCODE Possible 0x0a0a0a0a Heap Spray Attempt |
rev 5 |
2025-02-04 |
| suricata |
ET HUNTING Possible Hex Obfuscated JavaScript Heap Spray 0a0a0a0a |
rev 8 |
2025-02-04 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ibernoticias .com domain |
rev 1 |
2025-02-03 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ibernoticias .com domain |
rev 1 |
2025-02-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.ibernoticias .com domain |
rev 1 |
2025-02-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ibernoticias .com domain |
rev 1 |
2025-02-03 |
| snort |
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful API Token Request - CVE-2023-34362 Stage 3 |
rev 3 |
2025-01-30 |
| snort |
ET INFO Adobe PDF in HTTP Flowbit Set |
rev 8 |
2025-01-30 |
| suricata |
ET INFO Adobe PDF in HTTP Flowbit Set |
rev 13 |
2025-01-30 |
| sigma |
WDAC Policy File Creation In CodeIntegrity Folder |
experimental |
2025-01-30 |
| sigma |
WCE wceaux.dll Access |
test |
2025-01-30 |
| snort |
ET INFO Cross-Site POST Requests Without a Content-Type Header |
rev 1 |
2025-01-29 |
| snort |
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound |
rev 1 |
2025-01-29 |
| snort |
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound |
rev 1 |
2025-01-29 |
| suricata |
ET HUNTING Cross-Site POST Requests Without a Content-Type Header |
rev 1 |
2025-01-29 |
| suricata |
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound |
rev 1 |
2025-01-29 |
| suricata |
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound |
rev 1 |
2025-01-29 |
| snort |
ET TROJAN Nosviak C2 Variant Advertised Services in HTML Elements |
rev 1 |
2025-01-27 |
| suricata |
ET MALWARE Nosviak C2 Variant Advertised Services in HTML Elements |
rev 1 |
2025-01-27 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.drosenbloom .com domain |
rev 1 |
2025-01-23 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.drosenbloom .com domain |
rev 1 |
2025-01-23 |
| snort |
ET TROJAN Fake Microsoft Teams VBS Payload Inbound |
rev 1 |
2025-01-23 |
| suricata |
ET MALWARE Fake Microsoft Teams VBS Payload Inbound |
rev 1 |
2025-01-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.drosenbloom .com domain |
rev 1 |
2025-01-23 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.drosenbloom .com domain |
rev 1 |
2025-01-23 |
| sigma |
Suspicious Binaries and Scripts in Public Folder |
experimental |
2025-01-23 |
| snort |
ET INFO DYNAMIC_DNS Query to a * .fortiddns .com Domain |
rev 1 |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a * .fortidyndns .com Domain |
rev 1 |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a * .float-zone .com Domain |
rev 1 |
2025-01-22 |
| snort |
ET DOS Possible Brute Force Attack Using FastHTTP |
rev 2 |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a * .float-zone .com Domain |
rev 1 |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a * .fortiddns .com Domain |
rev 1 |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a * .fortidyndns .com Domain |
rev 1 |
2025-01-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a * .float-zone .com Domain |
rev 1 |
2025-01-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .fortiddns .com Domain |
rev 1 |
2025-01-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .fortidyndns .com Domain |
rev 1 |
2025-01-22 |
| suricata |
ET DOS Possible Brute Force Attack Using FastHTTP |
rev 2 |
2025-01-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .float-zone .com Domain |
rev 1 |
2025-01-22 |