| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a * .float-zone .com Domain |
rev 1 |
2025-01-22 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a * .fortiddns .com Domain |
rev 1 |
2025-01-22 |
| sigma |
ManageEngine Endpoint Central Dctask64.EXE Potential Abuse |
test |
2025-01-22 |
| sigma |
Forest Blizzard APT - Process Creation Activity |
experimental |
2025-01-22 |
| sigma |
Renamed ZOHO Dctask64 Execution |
test |
2025-01-22 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.n-et .org domain |
rev 1 |
2025-01-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.n-et .org domain |
rev 1 |
2025-01-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.n-et .org domain |
rev 1 |
2025-01-21 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.n-et .org domain |
rev 1 |
2025-01-21 |
| sigma |
Privileged User Has Been Created |
test |
2025-01-21 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.astraltech .org domain |
rev 1 |
2025-01-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.astraltech .org domain |
rev 1 |
2025-01-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.astraltech .org domain |
rev 1 |
2025-01-20 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.astraltech .org domain |
rev 1 |
2025-01-20 |
| sigma |
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location |
experimental |
2025-01-20 |
| sigma |
Renamed Powershell Under Powershell Channel |
test |
2025-01-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.masdiseno .com domain |
rev 1 |
2025-01-19 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.masdiseno .com domain |
rev 1 |
2025-01-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.masdiseno .com domain |
rev 1 |
2025-01-19 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.masdiseno .com domain |
rev 1 |
2025-01-19 |
| sigma |
Failed Code Integrity Checks |
stable |
2025-01-19 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.safira .com .my domain |
rev 1 |
2025-01-18 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.safira .com .my domain |
rev 1 |
2025-01-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.safira .com .my domain |
rev 1 |
2025-01-18 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.safira .com .my domain |
rev 1 |
2025-01-18 |
| sigma |
Exploit Framework User Agent |
test |
2025-01-18 |
| sigma |
Suspicious Invocation of Shell via Rsync |
experimental |
2025-01-18 |
| sigma |
Shell Execution via Rsync - Linux |
experimental |
2025-01-18 |
| snort |
ET TROJAN Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 |
rev 1 |
2025-01-17 |
| suricata |
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2 |
rev 1 |
2025-01-17 |
| elastic |
Deprecated - Suspicious JAVA Child Process |
deprecated |
2025-01-17 |
| elastic |
Deprecated - Potential Password Spraying of Microsoft 365 User Accounts |
deprecated |
2025-01-17 |
| suricata |
ET INFO Windows Update/Microsoft FP Flowbit M2 |
rev 1 |
2025-01-16 |
| suricata |
ET INFO Windows Update/Microsoft FP Flowbit M1 |
rev 5 |
2025-01-16 |
| suricata |
ET INFO Windows Update/Microsoft FP Flowbit M3 |
rev 1 |
2025-01-16 |
| snort |
ET TROJAN Obfuscated Clickfix Javascript Payload Inbound |
rev 1 |
2025-01-15 |
| suricata |
ET MALWARE Obfuscated Clickfix Javascript Payload Inbound |
rev 1 |
2025-01-15 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.ultimamilla .cl domain |
rev 1 |
2025-01-14 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.ultimamilla .cl domain |
rev 1 |
2025-01-14 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ultimamilla .cl domain |
rev 1 |
2025-01-14 |