| snort |
ET CURRENT_EVENTS Observed ClickFix Cookie |
rev 1 |
2026-10-01 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.coadautodoor .com domain |
rev 1 |
2026-09-30 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.coadautodoor .com domain |
rev 1 |
2026-09-30 |
| sigma |
Bitsadmin to Uncommon TLD |
test |
2026-09-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.gz-associates .com domain |
rev 1 |
2026-09-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.extratechsolutions .com domain |
rev 1 |
2026-09-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.gz-associates .com domain |
rev 1 |
2026-09-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.extratechsolutions .com domain |
rev 1 |
2026-09-30 |
| splunk |
Windows Defender Intermediary Artifact Was Observed |
production |
2026-09-30 |
| splunk |
Windows Alternate Data Stream Created Over Local Share |
production |
2026-09-30 |
| elastic |
ESXi Host Logs Deleted with rm |
production |
2026-09-30 |
| elastic |
ESXi ExecInstalledOnly Protection Disabled |
production |
2026-09-30 |
| elastic |
ESXi Root Password Changed |
production |
2026-09-30 |
| elastic |
Zimbra Swatchdog SNMP Command Injection Execution |
production |
2026-09-30 |
| elastic |
ESXi Attempt to Force Install a VMware VIB Package |
production |
2026-09-30 |
| elastic |
ESXi Virtual Machine Process Killed |
production |
2026-09-30 |
| elastic |
ESXi Root Password Accepted from Remote Host |
production |
2026-09-30 |
| elastic |
ESXi SSH Access Enabled |
production |
2026-09-30 |
| elastic |
ESXi SSH Session from vpxuser |
production |
2026-09-30 |
| elastic |
ESXi Local Account Created |
production |
2026-09-30 |
| elastic |
ESXi Lockdown Mode Disabled |
production |
2026-09-30 |
| elastic |
ESXi Account Granted Admin Role |
production |
2026-09-30 |
| elastic |
ESXi Firewall Disabled |
production |
2026-09-30 |
| elastic |
ESXi Shell Command Obfuscation |
production |
2026-09-30 |
| elastic |
ESXi Audit Records Disabled |
production |
2026-09-30 |
| elastic |
ESXi Curl or Wget Activity |
production |
2026-09-30 |
| elastic |
ESXi Virtual Machine Powered Off |
production |
2026-09-30 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
ESXi Syslog Remote Host Reset |
production |
2026-09-30 |
| elastic |
ESXi System and Account Enumeration |
production |
2026-09-30 |
| elastic |
ESXi Virtual Machine Snapshot Removed |
production |
2026-09-30 |
| elastic |
ESXi Payload Executed Against Datastore |
production |
2026-09-30 |
| elastic |
ESXi Virtual Disk Files Enumerated |
production |
2026-09-30 |
| elastic |
ESXi Multiple Logon Failures by User and Source |
production |
2026-09-30 |
| elastic |
ESXi File Made Executable with chmod |
production |
2026-09-30 |
| elastic |
ESXi Virtual Machine Process List |
production |
2026-09-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS Query to a *.coadautodoor .com domain |
rev 1 |
2026-09-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.extratechsolutions .com domain |
rev 1 |
2026-09-30 |
| suricata |
ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.gz-associates .com domain |
rev 1 |
2026-09-30 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.coadautodoor .com domain |
rev 1 |
2026-09-30 |