| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.ultimamilla .cl domain |
rev 1 |
2025-01-14 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.j2e .nl domain |
rev 1 |
2025-01-13 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.j2e .nl domain |
rev 1 |
2025-01-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.j2e .nl domain |
rev 1 |
2025-01-13 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.j2e .nl domain |
rev 1 |
2025-01-13 |
| suricata |
ET WEB_SPECIFIC_APPS Ivanti Connect Secure VPN IF-T/TLS HTTP Request |
rev 1 |
2025-01-13 |
| sigma |
Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation |
test |
2025-01-13 |
| snort |
ET RETIRED Possible UPSTYLE Command Output Retrieval Attempt |
rev 2 |
2025-01-10 |
| suricata |
ET RETIRED Possible UPSTYLE Command Output Retrieval Attempt |
rev 3 |
2025-01-10 |
| sigma |
CVE-2024-49113 Exploitation Attempt - LDAP Nightmare |
experimental |
2025-01-08 |
| sigma |
Azure Login Bypassing Conditional Access Policies |
experimental |
2025-01-08 |
| snort |
ET TROJAN CryptBot CnC Checkin |
rev 1 |
2025-01-07 |
| snort |
ET TROJAN CryptBot Data Exfiltration Attempt |
rev 1 |
2025-01-07 |
| suricata |
ET MALWARE CryptBot CnC Checkin |
rev 1 |
2025-01-07 |
| suricata |
ET MALWARE CryptBot Data Exfiltration Attempt |
rev 1 |
2025-01-07 |
| snort |
ET TROJAN Telemiris CnC Checkin |
rev 1 |
2025-01-06 |
| snort |
ET TROJAN DcRAT/Sheet RAT CnC Checkin Using MessagePack |
rev 1 |
2025-01-06 |
| snort |
ET TROJAN ShadowROOT RAT Malicious SSL Cert Serial Observed M2 |
rev 1 |
2025-01-06 |
| snort |
ET TROJAN ShadowROOT RAT Malicious SSL Cert Serial Observed M1 |
rev 1 |
2025-01-06 |
| suricata |
ET MALWARE ShadowROOT RAT Malicious SSL Cert Serial Observed M2 |
rev 1 |
2025-01-06 |
| suricata |
ET MALWARE ShadowROOT RAT Malicious SSL Cert Serial Observed M1 |
rev 1 |
2025-01-06 |
| suricata |
ET MALWARE Telemiris CnC Checkin |
rev 1 |
2025-01-06 |
| suricata |
ET MALWARE DcRAT/Sheet RAT CnC Checkin Using MessagePack |
rev 1 |
2025-01-06 |
| snort |
ET TROJAN Pushdo.S CnC response |
rev 3 |
2025-01-03 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.excuse .ro domain |
rev 1 |
2025-01-03 |
| snort |
ET CURRENT_EVENTS Darcula Landing Page 2024-01-03 |
rev 1 |
2025-01-03 |
| snort |
ET EXPLOIT Actiontec C1000A backdoor account M1 |
rev 4 |
2025-01-03 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.excuse .ro domain |
rev 1 |
2025-01-03 |
| suricata |
ET PHISHING Darcula Landing Page 2024-01-03 |
rev 1 |
2025-01-03 |
| suricata |
ET EXPLOIT Actiontec C1000A backdoor account M1 |
rev 3 |
2025-01-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.excuse .ro domain |
rev 1 |
2025-01-03 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.excuse .ro domain |
rev 1 |
2025-01-03 |
| suricata |
ET MALWARE Pushdo.S CnC response |
rev 7 |
2025-01-03 |
| snort |
ET TROJAN Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected |
rev 1 |
2025-01-02 |
| suricata |
ET MALWARE Earth Minotaur MOONSHINE Exploit Kit URI Struct Detected |
rev 1 |
2025-01-02 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.dnc .su domain |
rev 1 |
2024-12-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.dnc .su domain |
rev 1 |
2024-12-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.dnc .su domain |
rev 1 |
2024-12-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.dnc .su domain |
rev 1 |
2024-12-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.beerporn .org domain |
rev 1 |
2024-12-28 |